Analysis
-
max time kernel
142s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 19:15
Static task
static1
Behavioral task
behavioral1
Sample
5bbf2d831f817a323f6bbf416b1e4632_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
5bbf2d831f817a323f6bbf416b1e4632_JaffaCakes118.dll
-
Size
608KB
-
MD5
5bbf2d831f817a323f6bbf416b1e4632
-
SHA1
908e424daffbbde151d05c8cf7e2d68e354f9601
-
SHA256
69c72415fa806454ce8a3f29ca16292789c3f7ea7b68fe0610e08979119a43be
-
SHA512
a89ac0442f68be0c864d609c6c177399fef9f43caf62075af0610923cb7c0b79a22e88a3104211c24f7e428f197986ebf517b6db49d6723e4410e04eb1e73c6b
-
SSDEEP
12288:RZGQdqOGBaJqydLqQSeCqsVK8kPRGO35N9mVuzXc6:RZ0kWjeCVVK8kP9N9o6
Malware Config
Extracted
dridex
10444
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 3 2220 rundll32.exe 5 2220 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1968 wrote to memory of 2220 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2220 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2220 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2220 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2220 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2220 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2220 1968 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bbf2d831f817a323f6bbf416b1e4632_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bbf2d831f817a323f6bbf416b1e4632_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2220-0-0x0000000001E90000-0x0000000001FC4000-memory.dmpFilesize
1.2MB
-
memory/2220-2-0x0000000001E90000-0x0000000001FC4000-memory.dmpFilesize
1.2MB
-
memory/2220-4-0x0000000001E90000-0x0000000001FC4000-memory.dmpFilesize
1.2MB
-
memory/2220-6-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2220-3-0x0000000001E90000-0x0000000001FC4000-memory.dmpFilesize
1.2MB
-
memory/2220-7-0x0000000001E90000-0x0000000001FC4000-memory.dmpFilesize
1.2MB
-
memory/2220-8-0x0000000001E90000-0x0000000001FC4000-memory.dmpFilesize
1.2MB
-
memory/2220-10-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB