Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18/07/2024, 04:53
General
-
Target
563694b5b3e24156272e80505a060dfb_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
563694b5b3e24156272e80505a060dfb
-
SHA1
e95033c6a1c1a711134aedc993f56b953cd86efb
-
SHA256
692edebbe453068bc42b4ca091ef8eaf27c544777b71b2f17930bde34cd67698
-
SHA512
7fe4a9bb7d9ed79a7aba262c0bbb664ff2c6685a61ef8810f7b30fe17a888c44adfa2427c896087d567511098745c1e876f4f326024e9302248f9df83c0dba6a
-
SSDEEP
12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\563694b5b3e24156272e80505a060dfb_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵
-
C:\Users\Admin\AppData\Local\m1fHQcroz\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\m1fHQcroz\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\8QsFSC6Dc\unregmp2.exeC:\Users\Admin\AppData\Local\8QsFSC6Dc\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\FdqrMG2g\ComputerDefaults.exeC:\Users\Admin\AppData\Local\FdqrMG2g\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD57621ee690966cbcb9f31215ffdd15110
SHA1d9ae84f58d88b81d1153bc4d0d3c2de8d116ae42
SHA256de8b9d1eb318e34370327ab30fba6b8ab50894b056ee07ef9c6cb786f2c927e4
SHA5122d30aa6407c6b9b96d858092fff559e4add4a7e903078afdf8140e15c43023ecac3f2f207c148b24f91ea24393f4efe4b6b976785b70e524580ec935c1c7291d
-
Filesize
1.2MB
MD509fc9fc325765e325d0d1df2c8cec082
SHA183070939e7d8c96613266e26ba2e4a2fd298772b
SHA25692565831e76e5bb240fb541b6ebb0635bd056f6409aabe0eebf7d16875b054f3
SHA51297432a15ed2bbcc65ba9751953e6239ba49020ee31d8e7613726df0303cf959c157527bcd8e50cf9ffb0f9f69aa69e6316657ffdf9f6c44a98cdeccc1b9748a4
-
Filesize
109KB
MD57e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
Filesize
1KB
MD55ec9b7da1a4a7ff7d1ce5959bb2e1059
SHA1be23eab40559ea1db15e8b955039ba6e4bf5d798
SHA256cb4bfb6c96085760fbd580b1c1835097aa7ac76bf46a57d94e11cb39775f1188
SHA51207848e175de56282aaab2e07a81a525ffa2079426d36f0d9bd7251f767f68b225ac465b2763de33ffd91630b08dbd8b5e4eeb47a681dfab1a9417d4c8226764e
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
1.2MB
MD53c608863af3997b8b6c2262794ed3aba
SHA126afe227fe27ac5df5641840bde9ad3bd9404295
SHA2566e1732920b7f9c07737376d4292b3ff422860599c008f8c8b6f2ca36dfea4d99
SHA512f66411b66304b397e6e7bda827a056e663dcd4d8ad31bc4136e6672cf3632cde9b9f6054ba16695e92ca5aa1f37eccf0eafac6886995ee29cbb1e3eac8a5bd55
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB