Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 08:36
Static task
static1
Behavioral task
behavioral1
Sample
b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118.dll
-
Size
608KB
-
MD5
b3b37517a4b3fed4b3f36a12ed3bab01
-
SHA1
5f5486a5c2b8871e47616e7b6057a1dff820d882
-
SHA256
c28ffcfb26e3c131d375874f5e222b770c69c91da313b8568e0f1bb2562ef9be
-
SHA512
1d5a06e57a6932fdaa4724d04b86014560e688d066bff599dd215cb4e9ddce73a941a680592d177f6bf83b595d74fac9a015db00cf0d830e0e6c36e2c2f4623b
-
SSDEEP
12288:LZGQdqOG9NJqydLqQSeCqsVK8kPRGO35N9mVZzXc6O:LZ0/WjeCVVK8kP9N9oVU
Malware Config
Extracted
dridex
10444
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 21 980 rundll32.exe 55 980 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4712 wrote to memory of 980 4712 rundll32.exe rundll32.exe PID 4712 wrote to memory of 980 4712 rundll32.exe rundll32.exe PID 4712 wrote to memory of 980 4712 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3b37517a4b3fed4b3f36a12ed3bab01_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/980-0-0x0000000001F40000-0x0000000002074000-memory.dmpFilesize
1.2MB
-
memory/980-2-0x0000000001F40000-0x0000000002074000-memory.dmpFilesize
1.2MB
-
memory/980-3-0x0000000001F40000-0x0000000002074000-memory.dmpFilesize
1.2MB
-
memory/980-5-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/980-6-0x0000000001F40000-0x0000000002074000-memory.dmpFilesize
1.2MB
-
memory/980-7-0x0000000001F40000-0x0000000002074000-memory.dmpFilesize
1.2MB
-
memory/980-9-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB