Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28-07-2024 22:43
General
-
Target
2876b93cb21d6a2221e6ceb50411d4fd_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2876b93cb21d6a2221e6ceb50411d4fd
-
SHA1
3c10977925549acc722bcfe64e152a1d14d7ebf4
-
SHA256
39703d228241e44be2c2f4034de7002b590f762a909948a58fd48de07f007abb
-
SHA512
9e510ef96855375a0d0584a5031814397e404bc45daaa4c355de332e7675fca77bcbb4ac8263d821d512e114348ebb4bd1c74f2f2891aefbcf9fc4d5e269355d
-
SSDEEP
24576:XuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Na:Z9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2876b93cb21d6a2221e6ceb50411d4fd_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\jjcoh\sdclt.exeC:\Users\Admin\AppData\Local\jjcoh\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\f9KBYjIuk\ComputerDefaults.exeC:\Users\Admin\AppData\Local\f9KBYjIuk\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\dO26b6\wscript.exeC:\Users\Admin\AppData\Local\dO26b6\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD50c6c416ddb679485a08c4035a26308da
SHA1315186945564817ced31ad43c3e3786c9f12150e
SHA25693df266dcb8ed9279186dae251f38999036fc20e92439d90c5a242d7f900a449
SHA51257316b4b016a91ac63555d08ac1eb9c863dd463032d3c0ff1cce1864ef63eb9336ec9913704d428dcb16193d7a3aef4f8144ca71dd4b9e3db9a7dce098789433
-
Filesize
1.2MB
MD599ff0de80b940921117bc47bdb4ed6e1
SHA1e604cd5d1d29941f708187d5a42f677d2d427d54
SHA2568222b56b7bc178e535a199de6ce21a1bf37d0519e7641cb198c8db4d68a4afd6
SHA512ffcdabaf242564bcfd4e59555a936910008c1b1d391b74780bb92fce9e5a7f61d52c1cdf9859effc7eaad4d1c20114a0ea4fd18ecdbb1ecf42dc00c2c8f1bae0
-
Filesize
1.2MB
MD502d2321ff7baccd989270bc23ba44db9
SHA16577373be014a9581cd2a2ca0599573a81ccbe78
SHA256337f62b41eb0e56c545cae7248b5fa9054c29d6d690ddf9fe3e390a35fd2ab0a
SHA512b7c1b8e0380fe717ad235af565fff30cdb529f8bd34a41c740f3ae7a2d27c5ae3f24e89ac6d93f3a1154167b0cd3553ccbaea3d11f0daa39f5d392cf5451fd0b
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
718B
MD54959ee8ee8e66daabf92e6e38993864a
SHA120323008b1985f75672f9aba046f929bc82ca0ba
SHA25664e900160675f33873c6cfb038b0cec8229e3ee3bde6f5c22a8a8a318712a14c
SHA512cc9896dd9e9b9eb65ea45861607ea9f1e5a3cef5945694bb3ff55f437119f8dfed2fb687f32d12bd7e4635433ceb8dcef7597e67e8e289b159097529505117e3
-
Filesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB