Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
28-07-2024 02:32
General
-
Target
060a84bec4029d28ef32d2da09fb89f0_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
060a84bec4029d28ef32d2da09fb89f0
-
SHA1
01e4f103c7a644f11551433cd78daacb6fa120f2
-
SHA256
a6db43ae471602cfbfd5321b0536f3afcc8b0314e54768fa4f593303193a7337
-
SHA512
3e558efe6d582d27f042bcdda3b63c5075217a4cc1107474686c08fdac08d673c168bd61c1effe81e90d66401d3f5b75a15e61bb26a6af5fad4fc88d26ef1b0d
-
SSDEEP
24576:zuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:99cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\060a84bec4029d28ef32d2da09fb89f0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\H8PHNLq\cmstp.exeC:\Users\Admin\AppData\Local\H8PHNLq\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\ohNZk7gC\rstrui.exeC:\Users\Admin\AppData\Local\ohNZk7gC\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\S35wZu4y\Dxpserver.exeC:\Users\Admin\AppData\Local\S35wZu4y\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5bd10c64b2ed24ec0b3958b541de09d6b
SHA1e501044d9adb3b05aeb2360d9de2783229f99402
SHA256155866d861b17d6c2c239ecb99f3994b737ab76456387bb514efcc9be9799d71
SHA5128486f91687f359a9206a1fffea6479f12b222670fa054817805d33eaf734190d95408e2e2d55f9e0b5025a5e699a04e00f462b650e6284f0716a84c186b569bb
-
Filesize
1.2MB
MD5dd59b87d1962eae0841e391c35fd6ed9
SHA10b595ec9903c0121018601af63084cbd25bb3323
SHA25668688bf204adbfadd6ad851b79717880c82e9733745a5545660b007187954603
SHA512cc4b8cc868e2e27c824780cefcfd20155b46cc4be311b71b5f3be395215e663861e6ff0ab188ad64fb1bdce4b8953ad1fdc3abadf5ac73c02f843b69046ea6f1
-
Filesize
1.2MB
MD5d70664bbab9d9d5443ce979a48db3c5c
SHA1fd674048d884bc3dde4b6350cf02c35c12598fe6
SHA256af0c879256acc10e25351c051cef023ccfdae179c3f5a6705a34a900d9bed803
SHA5125ffcf8d824f26e8c40bfbc0c60aced7a12dd741b2f633a8af99b9947bc55d3977170ad046b4fd36bf09619dfe2d8085b1711a9a3cd5591efc8487fd65827df71
-
Filesize
1KB
MD57ce18cfe9fc1edec1ad6e4b23ca5da39
SHA1d11f506cface786c1954664389ab8f1b96afe91f
SHA25663937ac94ac08f1725dccc2bd74116032a7bf94cc36870c68b4a98813be23c54
SHA512edabf6e1d7ba92d04b3c354d431faa15bd9bcda7313d5372221318dde9af7100fcdea1489696894e056a9cd3ce273333c95700615af98915c987e6f7bca864f1
-
Filesize
90KB
MD574c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB