Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2024 04:13
Static task
static1
Behavioral task
behavioral1
Sample
676514125157e96345e544a2c72a4844_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
676514125157e96345e544a2c72a4844_JaffaCakes118.dll
-
Size
620KB
-
MD5
676514125157e96345e544a2c72a4844
-
SHA1
7063a2dd1e3b2d27ae864198e3df8b5b6ba9c5ef
-
SHA256
06e41c9e1128631c9e0c2174ed4b367d0f6ed7e3481fdcc95b24d66edd02a45f
-
SHA512
6b8805920b47e1334f72e2c9ad6a3c67ebf0f38613e22883871ba2761a1372cddf745f9a9fa2147b452dc95249290429ea5e60011b6ae60d024934af8f4e636d
-
SSDEEP
12288:CE6rSir4nbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1CO/zFZx:oe143j0dMZnCutz4zI5xDwXUom
Malware Config
Extracted
dridex
10222
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 29 4992 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 624 wrote to memory of 4992 624 rundll32.exe rundll32.exe PID 624 wrote to memory of 4992 624 rundll32.exe rundll32.exe PID 624 wrote to memory of 4992 624 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\676514125157e96345e544a2c72a4844_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\676514125157e96345e544a2c72a4844_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4992-0-0x0000000002910000-0x0000000002A49000-memory.dmpFilesize
1.2MB
-
memory/4992-2-0x0000000002910000-0x0000000002A49000-memory.dmpFilesize
1.2MB
-
memory/4992-4-0x0000000002910000-0x0000000002A49000-memory.dmpFilesize
1.2MB
-
memory/4992-6-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/4992-3-0x0000000002910000-0x0000000002A49000-memory.dmpFilesize
1.2MB
-
memory/4992-7-0x0000000002910000-0x0000000002A49000-memory.dmpFilesize
1.2MB
-
memory/4992-8-0x0000000002910000-0x0000000002A49000-memory.dmpFilesize
1.2MB
-
memory/4992-9-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB