Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-10-2024 23:42
General
-
Target
64aceb8bda31f573a45db0ea2c70c918_JaffaCakes118.dll
-
Size
872KB
-
MD5
64aceb8bda31f573a45db0ea2c70c918
-
SHA1
448bbb8dfded2f51b6b098cb2d650c961d0275b8
-
SHA256
00a4f5b50c281942629456327a8a4772f28e234abcb4dc6ecd755ff849714a93
-
SHA512
201c607317f291c84f417ca9b3c9c371c85140283c9d9279b62a8c46682224411ac3d612eafd95b606564893bea354df6af0ec7e443ae300e5862b591605e19f
-
SSDEEP
12288:SdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:kMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64aceb8bda31f573a45db0ea2c70c918_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\tDemivda\mblctr.exeC:\Users\Admin\AppData\Local\tDemivda\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\HHlJ0HYXx\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\HHlJ0HYXx\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\Nglk5Hh\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\Nglk5Hh\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
876KB
MD5389a649810454407896daf18f2d07a16
SHA1e66a33e3fc3e6331d5c1f707026fd5ebaa8f3be2
SHA256448e111572aaa84c614e7d87e618f8e7a12b55cff5286b8b3a50a266617ebb62
SHA512eb74f12782858b0bee1af4315c7e0f61534c4c460974fb767a3b305103377e922160072b1007476f80522aa9f037cf661b3ca1a81f9f0ce22d1ba642fbb21d2c
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.1MB
MD5d9f353270bff5a72db9931c249dd1498
SHA1afdd498c823adbbb501a730289b9f147d7e32370
SHA256d6e1c05da3fd3d968ec7afef99ab51d7f5b6bb2e7420cd964dd6ca2011f2207d
SHA51214404c74397953baebe7357432dfb73a1a0fccfa7264e3d8f916dfe2e6770a4a5815975201f3b4010af93885bb6a7be1f1d9025f6cc79ec0cac87e6eff51d1d3
-
Filesize
876KB
MD5a51e8b625024d1f15eaf8c87cad779f5
SHA1b0d03630d59f7ae4cb5d531cda85e3197b84d664
SHA2564212b14f66f08bb2da17fe3c008d0d1fd98b9ab3f0ac5cf8019578744cb48f3b
SHA512978c256960f0dd0a303b8886fba2da018330d29cb79e7ea7cced52e000de2293da2efedff467bdd98b0a0f76641db3faf03bb17720237b9125d9b8b3ac69ed32
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
1KB
MD5dfebed6b207f014fc014bea6e02fa0bd
SHA14c48a98d6bf7160c04440668577b0a7f75e2f88f
SHA2565f027edb1e5f74454f666759a245bbdbc9f88ca521fd063aa77b24c50066f87f
SHA512c24205215fcbc0a0f77ef720f65a7c585eb0ccd8992e733be24f4ea959477fe2a48a431d633bc6d890817acbb37a1329ea52bbb0113c9bcba63387c28b13b89a
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
876KB
-
Filesize
28KB
-
Filesize
876KB
-
Filesize
28KB
-
Filesize
876KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
4KB
-
Filesize
872KB
-
Filesize
4KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
64KB
-
Filesize
872KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
28KB