Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 05:49
Static task
static1
Behavioral task
behavioral1
Sample
351ed6731b18e89c5d201eaaf07a91c1_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
351ed6731b18e89c5d201eaaf07a91c1_JaffaCakes118.dll
-
Size
620KB
-
MD5
351ed6731b18e89c5d201eaaf07a91c1
-
SHA1
51689240440e52cc8828a65a9f3322aeb0d588f4
-
SHA256
24b645abc09a6674a5d17820a41e3bfe1237ae30da25cab97be54d652f6fd9db
-
SHA512
fed2d475e9247ec3784c4f3baf6b84373bc81675ca515420af11cd51d9e645c3c75c8e5838d6c9b962955a03cd68bf2ea64de131a7016f7c02fa354dd466f7a8
-
SSDEEP
12288:vE6rSiB4Sbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1JO/zFZx5:9enf3j0dMZnCutz4zI5xDwXUTmv
Malware Config
Extracted
dridex
10222
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 3 2348 rundll32.exe 5 2348 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2172 wrote to memory of 2348 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2348 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2348 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2348 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2348 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2348 2172 rundll32.exe rundll32.exe PID 2172 wrote to memory of 2348 2172 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\351ed6731b18e89c5d201eaaf07a91c1_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\351ed6731b18e89c5d201eaaf07a91c1_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2348-0-0x0000000000BC0000-0x0000000000CF9000-memory.dmpFilesize
1.2MB
-
memory/2348-2-0x0000000000BC0000-0x0000000000CF9000-memory.dmpFilesize
1.2MB
-
memory/2348-3-0x0000000000BC0000-0x0000000000CF9000-memory.dmpFilesize
1.2MB
-
memory/2348-5-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/2348-6-0x0000000000BC0000-0x0000000000CF9000-memory.dmpFilesize
1.2MB
-
memory/2348-8-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB