Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
a38752089760a995779233ec52ed1de4_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
a38752089760a995779233ec52ed1de4_JaffaCakes118.dll
-
Size
664KB
-
MD5
a38752089760a995779233ec52ed1de4
-
SHA1
814ad5b66d77826bb00b603456681d19c0c7a93f
-
SHA256
c94e1999d62bdbe743f08b2383083a0b70b41c7a136507ea66614aaf1403dddc
-
SHA512
c490226c8f455d409065b2a2a93f54f08f3397557e1630e0ce7b27057020114ff5c6b6a596d86b4b4db23b49bbad82d64d5d4bd489fd89abb47de02a26567501
-
SSDEEP
12288:L/0Qzqf0edi483M+6TFKywVt6PbEYU0eyJTT/Mu9oV01uHoaEPc:z0zhdIn6TFKywvCbEOxDMu9oyFaEPc
Malware Config
Extracted
dridex
10222
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 19 4520 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 852 wrote to memory of 4520 852 rundll32.exe rundll32.exe PID 852 wrote to memory of 4520 852 rundll32.exe rundll32.exe PID 852 wrote to memory of 4520 852 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a38752089760a995779233ec52ed1de4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a38752089760a995779233ec52ed1de4_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4520-0-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/4520-1-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/4520-3-0x0000000001360000-0x0000000001361000-memory.dmpFilesize
4KB
-
memory/4520-2-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/4520-5-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/4520-6-0x0000000000400000-0x000000000053C000-memory.dmpFilesize
1.2MB
-
memory/4520-7-0x0000000001360000-0x0000000001361000-memory.dmpFilesize
4KB