Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 21:46
General
-
Target
fd3e806f4332bfcfa93533beca89df80_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
fd3e806f4332bfcfa93533beca89df80
-
SHA1
d11032403375abd3d628e983a64ab2d80ab476c7
-
SHA256
2804e639a5387ba5851a66fd0aca15bec2e3e20fcedbe56b93136828af8e933b
-
SHA512
ed0bd11263b65dda4794aba95bbfa621c83377230ef333e89e245ec96befb231fa513b43937e0814d54591bef0faceeba7ffe11915e90191a0fb0cb74e7c4d0f
-
SSDEEP
12288:lVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:8fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3e806f4332bfcfa93533beca89df80_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\TtON\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\TtON\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\fZ8E2pDk\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\fZ8E2pDk\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\stpo\slui.exeC:\Users\Admin\AppData\Local\stpo\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5e971cd5b27a0c6cef5bd4c322404c98a
SHA152562ea45eb39b6ea46a47d0f2816be7fc17977f
SHA25690428944d63e080308681e0cb8f372267b16b5152164a523d19a287869f21690
SHA51210da1375e9b007e7878f5db228deb2c5c8dfd7160bec4532fb0999e4c62ac9026575d8b12e3e4d43721b0db9640ae09fb1ec5b5b7f041ee71e78262c9c5f0e0c
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1.4MB
MD5e368f79d043736d9844a60b3bef5c251
SHA113fe159facab571ea5571257fcc303088bd9ec53
SHA256c037f14ee795fa39d38593d4db38aa082f6a4b128887e274dc02664867d87480
SHA512d9b40426f0b289f29f951391c43d518fdb1bb0ebef240a39b858523a28cf7a2319814176db5e7e171c61e9abe4a30f2cc536aaaf951d0bdd30433f7942a1616b
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
1.2MB
MD516a7ca87c1157ac075131262fe31fa27
SHA1dd856d6186dc21627aa5e01c508a2dd636888dc4
SHA25686e468e00a50e0bd8f5cee09b7e1a967d936c22fd23dc683e9678d1cae1df28b
SHA51216fd8cebddfdda1a64bc666097e7c3a0961432abd5742141b88ac4163aa474d281f09f48c7537dfcb70d9173fdb87fc73d39b88cd4a2ae7bb6c2eedfd77ae9d0
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1KB
MD5cd1fb6e72add2942c3bf52cc6522b219
SHA1a53ae95c65ea2a4fb91abea8c97460c05443026c
SHA256d7a83f1bdccb7d614ce21905368dbd2384f718cbb98d19dd9287764a471a67b5
SHA512a6154faef795007eac2dff8a9304761e1ebd4ed0175afd38a9f8d1d3eed6c36ffc369a75d846fcc9585a075465beacfd77a55ca878c333a5f8848a9ee994c550
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB