Analysis
-
max time kernel
149s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28-07-2024 07:47
General
-
Target
0f3c2af0c1a23bc40eec9f73f691c054_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
0f3c2af0c1a23bc40eec9f73f691c054
-
SHA1
9b81c96e11542a05ce7b7e57aae15bc5b9aae3e8
-
SHA256
cf8cfd47e22b61c794f94665ca10aebc9466050a3cedc6489305079f9d1a8e42
-
SHA512
ae1a29dcff7326980b73de0419620ba7fdeba01a5271687145635a22d5c4aaeb3c62a30263a32a5fd2bbee15088544da443d4045fd71fc58a3e95b0afd39f6d7
-
SSDEEP
24576:WuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:W9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3c2af0c1a23bc40eec9f73f691c054_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\p7HKDXaR\lpksetup.exeC:\Users\Admin\AppData\Local\p7HKDXaR\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\gPMqT47W\TpmInit.exeC:\Users\Admin\AppData\Local\gPMqT47W\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\sufMgR3R\msra.exeC:\Users\Admin\AppData\Local\sufMgR3R\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD504c4aa4e2ee7b4763338a00330b426d0
SHA1b3591d38147698ff47f07e676ea90f9a8f9ac9ac
SHA256b5bded9484cbefb5280795435e127b9367ace1eff24608031deafa2ed2334121
SHA512c5167bcb439c5bc032dee42cb0cad73e5aa1015c7d9837ff8826e09e52f0c80187e1d658a19823815528ea0f8cd9a34e76100c75d6321f796fa431fd9ad22310
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
638KB
MD550d28f3f8b7c17056520c80a29efe17c
SHA11b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA25671613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA51292bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
1KB
MD5048241711b43b0a65638e1a9ce817089
SHA173490d8e1899483da2a3b0ef33a5f297ae8e234c
SHA25638e0be2f7466d81c47e8cdfd61a2f3c5a88e1fcbd99b0b0be24a2858c52037ff
SHA51291335b28eb24ee3df64478af990fcbdbc13d51a61863c233443f827dfbdf4023ef26e9772d5f1ce9a9ca4cc66519b7dcad27d6b4ee71f851c6b1c84c22e1393b
-
Filesize
1.2MB
MD56e06e03caf7eb3ec945adc73ea008683
SHA143e92fc918c38cd2a77f874c800b8dac0240e14b
SHA25609d7acfe210b183085cab763a4f23259c0915e8031bb185497cd649371a881b4
SHA5121a5e6903e6e7c4c295642c9e12cc1a8ad9e9629427a0d9451d2f795c553f9f03c5f0fde6d9c7ad477fbee507b4729cbb2f3fac21971ec2907d2658f3e20d382d
-
Filesize
1.2MB
MD5335b347c84d71ef9e103e9fc3eddfd2e
SHA16e6ce73350b47c49791a9a63897419aa01d5fe45
SHA256f370152bceb1c4a005f698bc8b1100159f98c1e75df2e636b83f503ae41377f1
SHA512f201f28097718f2fb3fa89e2cb5c25b6432312f305d39edb5ffc85611dd7e2837afeabe8098221446c0a196c29feaebe6747f2ff2e2476918990a7f5eba4d708
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB