Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-10-2024 14:05
General
-
Target
66f1c60cbffe0d19f4b0459ef14628ab_JaffaCakes118.dll
-
Size
800KB
-
MD5
66f1c60cbffe0d19f4b0459ef14628ab
-
SHA1
a1a37181f922c11159a5ea45272973e85563c7bc
-
SHA256
45e0689c0505e4d32d651eeabac3c15072558c57fa8ed3403bdc3ffbb7197f2a
-
SHA512
bf87f0a585bc271b99d3b4d2b966a40b70b147646489a730700f6ecd5fe095040ad0334955ff0845c00e6625e91a2726122b40f9a75530dcdfde7efef595b446
-
SSDEEP
12288:HdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:9MIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66f1c60cbffe0d19f4b0459ef14628ab_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\LFF\mfpmp.exeC:\Users\Admin\AppData\Local\LFF\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\yjOCSX\SppExtComObj.ExeC:\Users\Admin\AppData\Local\yjOCSX\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\3AOzATaok\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\3AOzATaok\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
MD5f63a3b8de872eb590af8586eba15503a
SHA13b5c2d9ebd9de35ad6da13177c10189fd9773216
SHA25615cdb2101298221b15dff1d0c7dd1049bece0316a163b227ce2396735a00bb18
SHA512e3f56221306d4d854ac3aa48cec8afb41906f206af07f406896ce72c9befaa79be6c0b49cfe40dc7d3f546fa6949900265f74b8abcdb92937112f64ec5c319d3
-
Filesize
82KB
MD5e4fbf7cab8669c7c9cef92205d2f2ffc
SHA1adbfa782b7998720fa85678cc85863b961975e28
SHA256b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30
SHA512c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6
-
Filesize
808KB
MD56ed733b1d92bd1d04f72c219c75b4e70
SHA1fc0a06ef98e660440ac503cb8c9ddd580cf39f0c
SHA256f31d2c291a23af708fe07f61320fb13dd0ce4b238e901e06caa5fd5f36134ba9
SHA51237809325cde78ebd1d3ac6bd21f6e9f05c3bf28986fee6f993f55e1593e8cf12681df994abde0c6ef9f6dce9364cf390968cc8c297a4cdc27e0c7a2d7e24a340
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
804KB
MD5d0001f5252a504464bda337d8b2b15c3
SHA1387cbcc6d3dbbb29a8893561b47262e1bf9b208a
SHA25611a3e5bbc2ce2476d18973e43bc20790ce0235e032eab2a2c78a9ff6e9d038bd
SHA512819f53195221051efce444a3a4df8bffdf7b6c160940aaec8670e24016028fc67491976013ab1ce3c56f3e0770a1b0cc3df622b9b3cbdccafe72088a2ed71111
-
Filesize
559KB
MD5728a78909aa69ca0e976e94482350700
SHA16508dfcbf37df25cae8ae68cf1fcd4b78084abb7
SHA2562a6581576305771044f07ea0fef27f77859996dbf66c2017e938f90bfc1e010c
SHA51222bf985e71afa58a1365cc733c0aa03dabd4b44e7c6a136eb5f9b870db14470201b4ef88a19fa3864af6c44e79e1a01d6f8806062d9d4861ba7dac77d82074f1
-
Filesize
1KB
MD59b9988c6ace16d8ac0f0e757c97a25c5
SHA1fa46f0525f9553d2f586fdff547f0672edb8b816
SHA2568b356f5d78f7d6dfb68e6a0410b48a2f0c7e1c681bdf6cb151ed12e6dbc98f6b
SHA5123eb8721ec3bcf476fc7c6e9e0dd857ac124f041633fbc1854bcb9dd1bd3e4bb5170c9496ecd9ec8e210d5dd01de6f9ed55d655cfad54b24df357c0daa20c8091
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
28KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
28KB