Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 08:33
Static task
static1
Behavioral task
behavioral1
Sample
b39e2d4ed0d4f9e27f33a431f6cf8a9b_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
b39e2d4ed0d4f9e27f33a431f6cf8a9b_JaffaCakes118.dll
-
Size
608KB
-
MD5
b39e2d4ed0d4f9e27f33a431f6cf8a9b
-
SHA1
3551902ce8b340a1bd834a68e4044f7bfd9f8683
-
SHA256
50cd54b0c2b933ff3b79cac46e54e74bc45cb5f6f46a141cd877a5b04a0f672b
-
SHA512
d5f30b0e7d8dc40ec427614c7bc0b24eafabf860773dd1392a3d3d0a4c62b4d9e027e21fb297541f581b256ea8cad72e173312cc35890261613234b8ec7999c2
-
SSDEEP
12288:7ZGQdqOGzJJqydLqQSeCqsVK8kPRGO35N9mVpzXc6:7Z09WjeCVVK8kP9N9ol
Malware Config
Extracted
dridex
10444
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 18 3392 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4412 wrote to memory of 3392 4412 rundll32.exe rundll32.exe PID 4412 wrote to memory of 3392 4412 rundll32.exe rundll32.exe PID 4412 wrote to memory of 3392 4412 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b39e2d4ed0d4f9e27f33a431f6cf8a9b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b39e2d4ed0d4f9e27f33a431f6cf8a9b_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3392-0-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB
-
memory/3392-2-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB
-
memory/3392-4-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/3392-5-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB
-
memory/3392-6-0x0000000000400000-0x0000000000534000-memory.dmpFilesize
1.2MB
-
memory/3392-8-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB