Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 06:26
General
-
Target
c141b9a07b0399778d5fec3ef4752733_JaffaCakes118.dll
-
Size
808KB
-
MD5
c141b9a07b0399778d5fec3ef4752733
-
SHA1
160d66bde8bb5c86a215373c547503c3f9b8ee59
-
SHA256
0d13f2263bec1f51944342a3480bd51290abf1d96b31bdaad78202ead85bf179
-
SHA512
f83207a62afd8425f98943f7346a8517ca3f2e05863ae5c90d9bcc1004df19201a9ea27c68eedbe3422a5634804b0cddb83560a2354988fff2a5e341f0d84ba4
-
SSDEEP
12288:8dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:OMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c141b9a07b0399778d5fec3ef4752733_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\IhAayQu0H\msdt.exeC:\Users\Admin\AppData\Local\IhAayQu0H\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\vh6NHsB\EhStorAuthn.exeC:\Users\Admin\AppData\Local\vh6NHsB\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\nz8C\rdpshell.exeC:\Users\Admin\AppData\Local\nz8C\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
421KB
MD5992c3f0cc8180f2f51156671e027ae75
SHA1942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA2566859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA5121f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf
-
Filesize
816KB
MD5fcd5dfcb39be974b55225863a4909c98
SHA1ca490062d1f3831524e04f639f540a8d421e9b1a
SHA256a048954641c17dc4566710c4d6a2b507f57a6899263f02095e57799e6fcab22f
SHA51270bc091fb5912a23adf4cf3839bc0a763d3fb4082f8ba515a81e6f92bd8634ad6156bc3f08b8af8b8628b92bb6da5dc83306fd1c15048616dc9d8e255c3bdf69
-
Filesize
812KB
MD5b824169be7bac6affecbaba42b8bdb7c
SHA18b6ba411b235edeeba25d6acf87c84285a3a5066
SHA256df8b7e306a7d09d43e3447db17dbace5092099d27c6b3315f9fd8d5e06f85d09
SHA5120867589a92d206fd67adae82e23475f498639059c22fba68e53f680cea7727fcf9e77ef23e9fbcbe714212409367ab2e9dcc8cba10bb40509ef1d175b83eccdb
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
812KB
MD5ce4671c68666a68c9da82f63641fa238
SHA172a5aa0572910eb5e99afa01a7838022dbd5de29
SHA256cf5accd5346c62ed5eef91bb3b4e45f37ece6dab9c4cc1efbe2c1316a6a78326
SHA51289fc2cf14e8d36196e0e4744b69da62975ded99583ccc15558d581f8803506d7f47d34cf156e493edd69284b17e7e0c15cb8dd1037959e3958ccfeb90a678ccc
-
Filesize
733B
MD59101b829838708695e3538ca9ee7b4da
SHA148bb7dbe123853426f51c11c43ffe0b85fa6301b
SHA25658f10867f5ba0b5cb5e4a9383ee2b800907f4928d61fbed1234e40f2d732cb7d
SHA5123a474c75a0e9d2024c28c74cca0de6a9aa3f8d8c6fda3bf94762ce29a6837dfab11b2485e7fb04c278c4648fbbc98b0fc535c569a2abffbfde11eab8dd68a222
-
Filesize
816KB
-
Filesize
28KB
-
Filesize
816KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
28KB
-
Filesize
812KB
-
Filesize
28KB
-
Filesize
812KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
28KB
-
Filesize
808KB
-
Filesize
64KB
-
Filesize
808KB
-
Filesize
64KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
812KB
-
Filesize
28KB