Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 08:01
Static task
static1
Behavioral task
behavioral1
Sample
0754d61449d4f3fcfb69b0689b3e86bb_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
0754d61449d4f3fcfb69b0689b3e86bb_JaffaCakes118.dll
-
Size
784KB
-
MD5
0754d61449d4f3fcfb69b0689b3e86bb
-
SHA1
3593ce27a49b18ab08be91c39be9400dac06a523
-
SHA256
42ccbdf9c7a08110c9940657d2d0748746c8639d61b7320dc830f70b79948c51
-
SHA512
3b3ec3c07d6bfafc163844e0877a5dc447d27c94be6ce5275715292b82d8d21df9940b012387deb6ba46046cfb958da9cde6bf09013b66df96a99ecf5684a206
-
SSDEEP
12288:MH2ijy7t9KVRxsYFPRSo5XkBCLu+PY1iqTrGaFhnt/vqqBhfN4MOFNkSr:MH2wgt9eDpSxP1iqTzVSqBT5OFx
Malware Config
Extracted
dridex
10444
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 3 1768 rundll32.exe 5 1768 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1176 wrote to memory of 1768 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 1768 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 1768 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 1768 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 1768 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 1768 1176 rundll32.exe rundll32.exe PID 1176 wrote to memory of 1768 1176 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0754d61449d4f3fcfb69b0689b3e86bb_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0754d61449d4f3fcfb69b0689b3e86bb_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1768-1-0x0000000074C90000-0x0000000074DAE000-memory.dmpFilesize
1.1MB
-
memory/1768-2-0x0000000074D52000-0x0000000074D56000-memory.dmpFilesize
16KB
-
memory/1768-3-0x0000000074C90000-0x0000000074DAE000-memory.dmpFilesize
1.1MB
-
memory/1768-4-0x0000000074C90000-0x0000000074DAE000-memory.dmpFilesize
1.1MB