Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 10:08
General
-
Target
93fc422ef8eef071e16c5b12310f6b36_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
93fc422ef8eef071e16c5b12310f6b36
-
SHA1
f1761280479126762632211380de0969d9295315
-
SHA256
9fe73d5332d83d76ee254a477355e48040194e781fd5c12b34f729a999e2554c
-
SHA512
c41316986dcc2359bff2eafb7f4d83403b792110a8257be28c706463957a785ac9c24aee033a02d10fc36b7a2327b655ecc751d3bc489aad4e73165390add566
-
SSDEEP
12288:idMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:UMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93fc422ef8eef071e16c5b12310f6b36_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\JKQ\mstsc.exeC:\Users\Admin\AppData\Local\JKQ\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\laaX4rl\EhStorAuthn.exeC:\Users\Admin\AppData\Local\laaX4rl\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\areJlR1O7\BdeUISrv.exeC:\Users\Admin\AppData\Local\areJlR1O7\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c8f912ab72a940a6c3aabe22fb3ffe18
SHA1517439d8ca2878ecf1f075c62bbfcac87bb9dd47
SHA256d06abcd8c54ac1dfecdb2a96b8ce6cd0b34f441ddcab7b89318c9c4c6b59cc03
SHA512d9a0beb2a033a5a6f0e0296ee8377f163f9b759a5b68ec7b62b22ffa0af146f3e4ee804dc04e919bd11644223e96fbad4e6f51a9e0a8c952f0eba0c3ceae9f58
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
1.1MB
MD5780e3daef13f14835b610375bd168d41
SHA14c24c11eaa550787ff2837ceb624523ef4a2e96f
SHA256cc4a967046deaffdb793a1e54e24b7ca8da6ebe57e4ec2df88a4305b48c4619b
SHA5123f3eb659fe3c4b3daa99929a2f3c52f61a56092514c7a1f4b5519422fd1ff0ef53cf87273c3e636c998b492cf59754495ef9fc1ff7490bc3388cd94008d33e03
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
1.1MB
MD5a6b0c066a9701a129217f7c1a8833ef2
SHA130436c43f835a1631fe60aadac84430012daa332
SHA2566bb41dd45de1d0802c9fba85c676557c1176bd468299df27b9b92315074787e6
SHA512a6f2f58ffe51725c709ce62823d6fe61b36bc6f27ce887fc8d8077401670817a544d9a24d42c7cf284a0b8d226fe91edb5b5de1dfad965e58689b777857ed357
-
Filesize
1KB
MD5f17666e9ca9b32f3efdd6ac303f1a535
SHA13282c3bd9e6e0df563f8ad766328534c52256f60
SHA25649a81dc0c8f45a52e3eea4f548d29209750e35b36379b843da41111afb57333a
SHA512f226301c6ad4a05255edd5817d3433660bf1c1caa1e071be8e974aa42791e215dcdd77348c777371b38b8bbddf9af67d899eeb4c664d8e7296d90f235c2f4f86
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB