Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 16:03
General
-
Target
35a49d0b8e5d1748ef8ed60d646e62b0_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
35a49d0b8e5d1748ef8ed60d646e62b0
-
SHA1
4556bb402441ff4ed307b75c4fc54596f78cbd15
-
SHA256
bad0daeaf20a474f44a060b49aa175aec0145a1a1765881426e1e6781f22b543
-
SHA512
7bd08faa1a6eb6b5843f78c40d70c4488f1f997c3b099287142c54af0d1d35a57073946ed7700fe832b129599fff895824ba1efea55cde58adeaa668be090b54
-
SSDEEP
12288:PdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0Ty:VMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\35a49d0b8e5d1748ef8ed60d646e62b0_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\9hXAq\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\9hXAq\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\G9j\rdpclip.exeC:\Users\Admin\AppData\Local\G9j\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\4wHD\SppExtComObj.ExeC:\Users\Admin\AppData\Local\4wHD\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d8ecf4cda75a0ebf2d6e30a8f7e70a41
SHA183c75c0552254c4dde3020aa3a4720f0aaff119f
SHA2562ec864719a691dd1796866d7b0d0b2871339ecb99a3426ba5f0dfac47eab3949
SHA512331cb349aed879f2a1b2bad32d7025c8d3a84bad1c88c0202b68670238256ae7c560b76904318cde8e46d553dfaa1fcbe3001325ed7736ff48f7fe53d589a538
-
Filesize
559KB
MD5728a78909aa69ca0e976e94482350700
SHA16508dfcbf37df25cae8ae68cf1fcd4b78084abb7
SHA2562a6581576305771044f07ea0fef27f77859996dbf66c2017e938f90bfc1e010c
SHA51222bf985e71afa58a1365cc733c0aa03dabd4b44e7c6a136eb5f9b870db14470201b4ef88a19fa3864af6c44e79e1a01d6f8806062d9d4861ba7dac77d82074f1
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
1.1MB
MD5d27c5c62513a615ea61697dd1d361754
SHA18bb3087ea360efe40e23f3a0e838042d01931112
SHA25655b934aeae356e66ac5f7972b3c5d06daf52209baf00884b2bab5ad6166506fd
SHA512ba7b0f315fc0d0a7fc6ad71d18595d5e0d4108532347674ecb20396d64d1e1f08bd467111084dd5db5a537eebd4dd9623a189e3360493bebac5ab4a18ddd0445
-
Filesize
1.1MB
MD54a2d8c65ce538816a7f1cc15dd1a5790
SHA125317333fa82a7c804b7de2ff0f345dabdfc7255
SHA256ae0450e1135b24f96274aaa88f5581c5a5d200f8933d9078c8a6189685c4b919
SHA51249e67b51059d1ea822f768f568acade3369f93b71f7d252ba33f7a64ca37d1d78d45d4b6d46a93bc47db4f3c2103b8af0a45b9dbf4d3546379806436ecdc9401
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
1KB
MD5e547d9abf159afa56ea8193a08d3ce17
SHA1e428ec5910a5ce92099186ceac75fa0867b62dbe
SHA256f1fbdf983abd9a444f46db8d01ecae044e2e924ff399ad931b33f104d886d202
SHA512e81ec763ddc2f248fab6315b491b61cabb3f57a2098c40e295baaaed7304174e79044b48b1062df71def72c7917297a6de5fdc29f314480b0d31d46a59df6590
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB