Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25-07-2024 11:58
General
-
Target
6f7a623c394f68d9d01256a739dc60b8_JaffaCakes118.dll
-
Size
816KB
-
MD5
6f7a623c394f68d9d01256a739dc60b8
-
SHA1
80236913566d2427f3f39e866340434ba501726b
-
SHA256
bb2072b180f158e3c9473af4d94abe6989741d81f72861e4230c35ca2cb04b04
-
SHA512
fbc4702c4005335ab90a6f038d92947050d5626c5560b40ce6bfc07bc1ccd9fe7927879de97717a294349124a37517f4f22850ffb82f42479aedb1eeb56d38e5
-
SSDEEP
12288:zdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:BMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7a623c394f68d9d01256a739dc60b8_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\gbYwjiR\DWWIN.EXEC:\Users\Admin\AppData\Local\gbYwjiR\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\FKv\wbengine.exeC:\Users\Admin\AppData\Local\FKv\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\RVckV\wscript.exeC:\Users\Admin\AppData\Local\RVckV\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD5ac5f980cc898d336b8e57813d58fa82d
SHA13790fa16287f1c080d573b06629a5b0ce46b6e85
SHA25629ee767ee9e41aff1d32124a13c7949884fabcce01edd668c64fe56333aea671
SHA5122a8a771bf9e7ab82c53fb01b3fcc9d2d2adf37651f13d65af3697a670c9dbb94c0849d43b6e970892d68a808e754bbfb6f4b6a01f869b6e417d41bb592de8d0a
-
Filesize
820KB
MD5aaee068622c22ce3fe1d96730cb89330
SHA1a20aa42e8f898e72e5b0d35142fcdb664b8ac0a3
SHA256b81a8e8e0344ce05883f520ef929d962e06184cc83cde2001a1423b018d03772
SHA51201fbb8f72506ed29e9ffc96089de5f6069ee12b93b47a5705ab6d2cc1ce970b6cb4140bc9d29d43d9382d807064b96a88de83c93a75c9b746aedd5d8a9e35b21
-
Filesize
1KB
MD540e44fed3007a5b6c3fa320054e6f36c
SHA184f8e185c7fabd7650d3c109327c3a5df62a04ee
SHA25618913523eabca6e3721f33de544e55fb5c40f2bc74b7a048ed8282955d5c336e
SHA512ecd68860d3d4c7289e7e8d5bdea864442acb039e53ab44ee5bd4e35da087db5a3d77a04922c42453ce33304eb5c7b89c9ba4c6d499d3a819e590f471e9a4c669
-
Filesize
820KB
MD5d408d37ba09b58b80a90bca869580925
SHA14ada6044057114b05527cf0defb73b63f331e5cb
SHA2568668816ff1e702b683ed7b0fff12e3c11433fe03799e1d2aac1ef2a2b2d39d96
SHA512bf6d835a3aa2d202c0fad38e457f2f228c58cfd114aa8b82252be3d2de5f42ab9efef01a1c312e380488629738b49180e44c3be758f3368d18ed71238160a2d5
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
28KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
28KB
-
Filesize
820KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
28KB
-
Filesize
820KB
-
Filesize
28KB
-
Filesize
820KB