Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 21:07
General
-
Target
034426c5bd525235fcafbbb062e0906c_JaffaCakes118.dll
-
Size
840KB
-
MD5
034426c5bd525235fcafbbb062e0906c
-
SHA1
035feff6c9fd3656aa4e91d9478d78fac9cab06d
-
SHA256
eeae042764b330ce8fcf47e9f959389658b9babc7d9bf84b9836adc1fec4565d
-
SHA512
182eefa4e540076bf5d65f193142eb6b15713c2449d2a45c788b6e6fcddb241a542fe763481c5eb6673d6861642efde081d3ee3cbb9421e51d0dba1f4980fc76
-
SSDEEP
12288:PdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:VMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\034426c5bd525235fcafbbb062e0906c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\z65mdXshH\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\z65mdXshH\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\xlo34J\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\xlo34J\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\0QZ6V\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\0QZ6V\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
844KB
MD5fae72987661b7ba83457e57224d7de2b
SHA1098c0d53ede93f257b9006bc729fb21200f87297
SHA2566569b33915463a9e0ca72335ee4ebc7315293cfd93ce225b2efb4fe2ea9443b2
SHA51245924e5abd903cc6de836e49babe53cd57999e241ee42f1b185011ef65d7ad8d04ed432c10eb3ab61e0904762f5c1a700aa800ddd9ca96577304854c703cc40e
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
844KB
MD59e1a6fe341c45cee5a2ee2def1c3f576
SHA198d275ed98125ee531acf494dde79411491c7087
SHA256eaa5908be9791215f18089db3cd0e22e7e553f7bc80fc59db2906de5c04c9900
SHA51283fe552c0065ce8d45b493f066eb4587f6dce47045c0daa4aba5068dc412e952d9b08dfc6778be6c43e926b78329fe14c660222b22e102cba6fd445751addc7c
-
Filesize
844KB
MD5a787238fe7b9e6af1bd6c6754b930833
SHA19169c93758c759a2a07d10fb6e970f3169ec7fed
SHA256da6c33078ff6e53b3c5b47dfa73ea1749e9e62a4e00ca194a475a89054b7cf58
SHA512a44028ed5e97f2d30a3af9c03ea5cd0bec906627df033ed3096fe67075d901d9371cd4a1177e273288a1c37fdab0cbdab72759b6ddd6c5b4baa9cd120d9961e5
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
1KB
MD5d1426e70373a10613ecc1126e17f3602
SHA1c7322471f15b24fa6ef362894c8a865e0ab3a298
SHA2562d281d8a5d99df0081a45497ebbdf0f050ef9b9af8bb03cbc06f1345517bf507
SHA512f69235f39321988fe2f94436cfa1d6808b6037fe67761f786681e0a256e7e729c7e639e5c18cc20e51319dd3eefb0e28949967ddf44eb7cbe0f8b5d17c68507b
-
Filesize
844KB
-
Filesize
28KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
64KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
64KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
28KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
28KB
-
Filesize
844KB