Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 19:22
General
-
Target
ff362bd68f2c0d7edc8ae6daea65bff2_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ff362bd68f2c0d7edc8ae6daea65bff2
-
SHA1
13eec145c843327764da8f7b7bfd7497f36e9fd9
-
SHA256
93c6d28fa2d592b75125079c8830ee790701ab730ba25a3a540c29ee6b7ecd01
-
SHA512
c9bcaedff9f396bf4f00877d91b22c13c58cb8c31a844520424cbd8548412de6c8d02262e43eeefbfcafad5eaafaa2b767490b97efae036c7e55d671df2af5d6
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N3:F9cKrUqZWLAcUv
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff362bd68f2c0d7edc8ae6daea65bff2_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\xsx4NZ1\msdt.exeC:\Users\Admin\AppData\Local\xsx4NZ1\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\iqpQb\psr.exeC:\Users\Admin\AppData\Local\iqpQb\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\b3hpVrvk\dpapimig.exeC:\Users\Admin\AppData\Local\b3hpVrvk\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD550e65476ea6e1ab0587e9777e607fff0
SHA1b0a78be1716a4e8bfcd9b6fa6965fd0ba7e0a004
SHA256dc3e81ed43f141d4556d88a58c3bfb8c5198dde0c3433a8ca3fad1d3971acbf2
SHA5122683dd912d4e7b10984e6151b9215d5ffa1019ce4dc01fcf880fc6f3b3a3b1cd485b7b7c8aa982965830fff63ce270ca56b3b45663fccd7bf5197dee07f5e9c0
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1.2MB
MD5e5dc3f11e6188fa802177d3505e98c2f
SHA10e8f18ec49ba6b859f214ee9f21bcb878342b175
SHA25645f05672551308ed2e25793eaf50109349fe6dae93244bb3c61ebec87eb518e0
SHA5125b6337101bd983e642d2661592930d172e07f975bdeb1e8788a1fc669a4a8fd3ee6ed7e0c082f781399524099d63faf69d31c174bc129364e8b577a7e70cd86a
-
Filesize
232KB
MD5ad53ead5379985081b7c3f1f357e545a
SHA16f5aa32c1d15fbf073558fadafd046d97b60184e
SHA2564f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f
SHA512433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0
-
Filesize
1.2MB
MD5a7d923fac93a79038729e016642b2715
SHA136e8c319411de8aa66cb4d83dabb6ab1d3aafb18
SHA256377d68f322fe876127beb0073ece8bd6d234b5ab1d50c42732de7ff56205d96f
SHA51260f405cca96190742463e0d0c51196061c6344acf35347dd8656a564fa07db457956b1fb79e0726180fe505e3f5e7b8bed431ef05ebbc43357bc42598fbe7905
-
Filesize
421KB
MD5992c3f0cc8180f2f51156671e027ae75
SHA1942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA2566859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA5121f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf
-
Filesize
1KB
MD5f4920cd2d2c060887c2af3e608a5f1f3
SHA16ea65375841291ea84deb349413636b5a4f7ba26
SHA2568c66c0f27ea8629bac642a40d5361e99b7baab4dace7cc419da6f63a781a6315
SHA512e49ead99de1df2f5bbee06a720e6b0f07f1f967eade4efe9f9739132791a81b52b665f22a8759c7686887f141cdd92b100b87a9f3f96f49ddd8b2a1d5219f551
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB