Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 16:54
Static task
static1
Behavioral task
behavioral1
Sample
9204f297656515a422d2d6403d26115f_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
9204f297656515a422d2d6403d26115f_JaffaCakes118.dll
-
Size
664KB
-
MD5
9204f297656515a422d2d6403d26115f
-
SHA1
7b0bfe9bba9c133fd455f60c7d0627bbc9d9c2a6
-
SHA256
66562be2e93162d4f91c9c6fa7a79c7dc270eda727488eada10a24b6c23dd62d
-
SHA512
406c8f49086b35dea2ed9eb42ec29c5fb468dc317369c3d19a4e2206714e04c574006f50d8edef8b9ebb60d642c7b2059aed51b9a9cc41d717e42572e465c0de
-
SSDEEP
12288:q/0Qzqf0e7i489M+6TFKywVt6PbEYU0eyJTT/Mu9oV01u9oaEPu:g0zh7yn6TFKywvCbEOxDMu9oyfaEPu
Malware Config
Extracted
dridex
10222
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 19 1656 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2164 wrote to memory of 1656 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 1656 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 1656 2164 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9204f297656515a422d2d6403d26115f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9204f297656515a422d2d6403d26115f_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-0-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/1656-2-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/1656-4-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/1656-5-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/1656-6-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/1656-8-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB