Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 15:36
Static task
static1
Behavioral task
behavioral1
Sample
eb663da7d960ab7736290075b46998ef_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
eb663da7d960ab7736290075b46998ef_JaffaCakes118.dll
-
Size
604KB
-
MD5
eb663da7d960ab7736290075b46998ef
-
SHA1
048f6ff1044ecd925654b86f8dbcc62a500691e0
-
SHA256
1c3f402651ec7acc0f84753b8a3913ec5b9abb7e0350fe4c88fce7b3ed364ec0
-
SHA512
c0e05cdc644371aef34b9641d9a493844ad347010886e2447fe44c104c75dd95e560bc5c52e315c719198f5f5c3833f699251a01b4ecaecd30d8733b534d652d
-
SSDEEP
12288:MuIBRuwMtjp4CqwqyaXPLAfx38TW9DiWUT2tq017JGoLbfW/:Dbb4wqyaDA5sTWiXT2tq07G2S/
Malware Config
Extracted
dridex
10444
174.128.245.202:443
51.83.3.52:13786
69.64.50.41:6602
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 15 2612 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4588 wrote to memory of 2612 4588 rundll32.exe rundll32.exe PID 4588 wrote to memory of 2612 4588 rundll32.exe rundll32.exe PID 4588 wrote to memory of 2612 4588 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb663da7d960ab7736290075b46998ef_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb663da7d960ab7736290075b46998ef_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2612-0-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/2612-1-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/2612-4-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/2612-5-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/2612-7-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB