Analysis
-
max time kernel
150s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
28-07-2024 03:38
General
-
Target
07a9c9069fed354bde90b7a3483fe350_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
07a9c9069fed354bde90b7a3483fe350
-
SHA1
859af6f560ebc2bf44d5c61c517dfa89141c924b
-
SHA256
7e33cdea0bbc985977bc213b140f31ca542a35ed3d3b2f7d69bf52d691776039
-
SHA512
5cb95b1b195b0594f34c1736036498457ad1eb2ee772d415dc14461ed92c0dfb801e012da9a4f758085e5cdbe1cc8c89f20aa6ed4c5147b3fd2384de013be885
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07a9c9069fed354bde90b7a3483fe350_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RDVGHelper.exeC:\Windows\system32\RDVGHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\jPrnwnpMr\RDVGHelper.exeC:\Users\Admin\AppData\Local\jPrnwnpMr\RDVGHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\UWKCdY1\rdpclip.exeC:\Users\Admin\AppData\Local\UWKCdY1\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\gbllp\dialer.exeC:\Users\Admin\AppData\Local\gbllp\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5646eba96beb928fa9fcf0a4a09f6e5e5
SHA1f273426823e7220194bacee6055a37fe9ac112ab
SHA2561b06c44bdcbb8023c562eedc7bda0ab3d75cf01bed53a20eb8dc08105c05b65d
SHA5129ed6d115034845c79228b46e9fbbd174e80c0468e59e0877e3331b56b234462ca574d76ded9f3a5bfe7dccd17fdb8daefd8260ec123840fcf819409b1f0ff99a
-
Filesize
1.2MB
MD58ba209d62cc5ceb6e6a4ccb9369ebb09
SHA155e8f8497bac787da09a62b017dbea2ff5472bbc
SHA2566615227fa783acd1ad3c7e6137da09fb7a0cfaaf6c6fbbafa70a159a46ee6acd
SHA512b92e75740eeb9b2a3eabfeec1acbe9e3f7d3b3b86f4b81c5817d2cd3fccf1a6322b78fd8e3b8fa8854c7e0fdd3be99403de10c9a4ecabd3ebf63f6a3c196404e
-
Filesize
1.2MB
MD527093b62cb6041c77bf11303464033df
SHA182406bda2e513cd84f848409e59d5728acbf6679
SHA2569ce7d101b44878fa61c22e380db001aac8beff5845d8a3bfeed8cfc347cd636d
SHA512be0476cf668069713581dc90c8548c4e91428cbf99ecceb2ec35cd0b303c419b69182113cf783655dba3006ab82d1ffb67a7e5b408f16eda2e7279860f1a74c0
-
Filesize
1KB
MD553d22ba798fe7bdb99d22bde7df74e6f
SHA186f07e3e7628494769ee0d88febe26d64d690725
SHA25666eaf6084537619e8d8f5b7578d2eda6abca626b669358d16b1da3c33d61733a
SHA5128bd723813cfe5a2622d5b747f839996012933b2f76a488c38caed22f3a3517425db59ac9445734601aec0601185921eb1400193a4db2ca1039adff974d30f815
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
34KB
MD546523e17ee0f6837746924eda7e9bac9
SHA1d6b2a9cc6bd3588fa9804ada5197afda6a9e034b
SHA25623d8a6a1d847a324c556c30e10c8f63c2004aeb42ac3f5a5ca362077f1517382
SHA512c7117c3778650864e685bd89df599d7cdd9319d757344ddc7cfd9403d6673964127f6ff0c5ac48455fd3097af31a6ff09173f85dfa7be2d25f395cdf3692bb9a
-
Filesize
93KB
MD553fda4af81e7c4895357a50e848b7cfe
SHA101fb2d0210f1c47aaf684e31a9fb78f89bba9c0f
SHA25662ab8c2c5b5bd84fd07e96b6a3b87a4ea56946107ed9b7f8076580ae1fefd038
SHA512dbbda90a57d27160c5a3a5e4e94cfc43b1663fcbfe424fdec851e52356f61492bdcf677c46be8aa4e8ccc8be7c389b6aa7bbbce8447e1fae32f03e5e409f4051
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB