Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28-07-2024 23:52
General
-
Target
2c083f8ebf66a7c0ead55769be9f6585_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2c083f8ebf66a7c0ead55769be9f6585
-
SHA1
cefc2e8de8b5d48136afb11147374028cac9cddb
-
SHA256
33dc43b0e4574bbc29a2f77c51fd830184c8b3c2f9ae34c4b9a762e44b8b5b82
-
SHA512
b3a9c52ca44616593d8a6c72bde20962a20ee71ae0f5c9c886d797d89c5f3dc7d9834865cf829dac10f00dad867d69c8369755fdccaa14d8b8df698dd7963f5b
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c083f8ebf66a7c0ead55769be9f6585_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\DhNs\slui.exeC:\Users\Admin\AppData\Local\DhNs\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\I6VbAt\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\I6VbAt\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\yPk\sdclt.exeC:\Users\Admin\AppData\Local\yPk\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52c14734c6e0421503b20a90e832767b4
SHA10ae9c7a5b972bc581a2e86e670f3986264e72577
SHA256bbaece99521dcd537f4f64ae502a984db34c9794855a1684279a5ebd6ba75289
SHA512f9f04168833c72807a7ef52a7c4bd1fbf22f0e44fa5a7b9502a6d74cb895b5f7d551ba9d6f7dbf773a4a2976f08477bd973b614fecd0d0a88b67d9d1639710e0
-
Filesize
73KB
MD59728725678f32e84575e0cd2d2c58e9b
SHA1dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c
SHA256d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544
SHA512a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377
-
Filesize
1.2MB
MD5d64fff489848373c4a46680e89121f1f
SHA1533acddeeb0320546037924c2660fe2ba21eecde
SHA2568696c01fe9427cf7bf30aaa7970cb539b52a98bf290f6c79352111744fc06084
SHA5128ca7434f3d1576e2457a8a073bf5fe132d2ee8cbf34574755e7a8e0ca6e79955b867d778c00d7103746a591d30125b32cdf531d6af89329321db65a46cba7078
-
Filesize
1KB
MD5f0dff40cfc9f7443c1d2eb018324fae5
SHA1f3f012e44bb7580e7a20876de22c8f82c1466f32
SHA2567c0256c943ce76eaf8c9e3168e4016f041afc336292d99af6b378e4d1dc96725
SHA512c38ae0641e7c67b9d269e436839aa5e02e71de4a544210dd89e1161af2fcdc31fa6756d02307b968fab24e8017a79b102183263f7085c8a4f6ebfbc671bbdfd2
-
Filesize
341KB
MD5c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
Filesize
1.2MB
MD5ed88ca758802a5690962ce15c1f34b3e
SHA1ff93049060fbe62fa98a0646f6b88fd13d1add52
SHA256ac8a4f5ba25af0f930befb7a42e76b54d06652f1c4e6ca03785caad5db21fd35
SHA5128c4944935961cdc4ec61c42dedb116ad4e7bb41f6a347b2fc28b01035b52a623db5c8cadb92fda98f2551828a448e6f55886dd04d08203d1d763153796ee4167
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB