Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28-07-2024 21:56
General
-
Target
2659ed2cb4afab7a842b055f23ffd340_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2659ed2cb4afab7a842b055f23ffd340
-
SHA1
509080204bd698f75f5096799f1bc7c13ecf79d9
-
SHA256
26d370fac05289d2d7895acb5ab970e500769b0fff27e5807a0edf36a662926f
-
SHA512
5819c6ffcd8b7ae10b2d7f5694eff3d1d19645273ae29d161e0a6ab975fa33b8d75268292c5d257c77172202afa38179127d46d1592c9ff7667523acc2186a1e
-
SSDEEP
24576:euYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:e9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2659ed2cb4afab7a842b055f23ffd340_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\4Hcr5Ab\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\4Hcr5Ab\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\1lggHc\Netplwiz.exeC:\Users\Admin\AppData\Local\1lggHc\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\CXD\FXSCOVER.exeC:\Users\Admin\AppData\Local\CXD\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD595842ec71242fa17ac8347a684b7e6e9
SHA1f96ce4e1f31a2e5fe22ec07dcb12bf08f671834a
SHA256ce6e7408fddde24d8ebf17588a44ee8b3a8ec3480a12586b79c6ae52606e5b5c
SHA5125f71c108e158372936acd9c9ba5ead118c1e55d0dce1871e3984cd4e5f48dc0d1686d42490d80f05000acfc09d8701766dde72b21136a1cfd33016daffa8f3d3
-
Filesize
26KB
MD5e43ec3c800d4c0716613392e81fba1d9
SHA137de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08
-
Filesize
1.2MB
MD5e26fc4dd510e8da154418cb4a76277bc
SHA126960f0588931ccced0312b4674efef77c8ec329
SHA256eb14288548b71bdf2d0a56e06c287c6a9ccf7ae0a067f60c45c8ca000d0a63df
SHA512da60748be249bc03be77f4f5468b8b1745d95953f656e5c763f926bf59786d4d9f1308cfd5df6f748085c3ffa1c90519b5bcc1985f9b684fec9b9a5dd3a36e19
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
261KB
MD55e2c61be8e093dbfe7fc37585be42869
SHA1ed46cda4ece3ef187b0cf29ca843a6c6735af6c0
SHA2563d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121
SHA51290bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b
-
Filesize
1.2MB
MD5bdfc173d1b0bc38a7a2c514890345b4b
SHA10a40866695085af0114cc945c0cd29b3dab67688
SHA2561e917e24174a884455f6d1bf7531ceb17dbdd5d215381f80a71b74128560d647
SHA5127d2d55ed34a57568a650729aef79dd6bf075193ec160990db93647e1b86a1d5f008c82424b6b9cc333622b2c6ac55f36c7448363f2f6214352471e8f933f2838
-
Filesize
1KB
MD5d5409ed5135f2e64493aa14d33e25cfc
SHA129613055704a8622dc379c5aafbf6e63083e2f57
SHA2569de1f37d38b7eb240048ba2c69e38e598dd8808229ec1f4390d4bb5046f8f0b6
SHA512d876d5aa7890a4f2fbd59a9e3b501f4dddd505518576c031d9360118ea035cb4f7c5bc9aef07e67e28d57163e93ff7cca64a217bd09cc2d881fc58ce74fb0fd6
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB