Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
28/07/2024, 10:17
General
-
Target
1452f13dc50be7b78017d4984f0b98c2_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
1452f13dc50be7b78017d4984f0b98c2
-
SHA1
df176b802a4a5c9d9bad302c5116b7688c219859
-
SHA256
3fd4e602beb3bc04479f55c761c27cb0ef1d8011db499266eb6615d75d53c067
-
SHA512
af5e290af613a833236deb680d3bff9be6cfc60a71f0581edc7b15351cf385c79d5053366e39597030334dc6a3d7a62f32cc01ace478b9640c4fa4fdc28e5d4b
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1452f13dc50be7b78017d4984f0b98c2_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\xynJo\Dxpserver.exeC:\Users\Admin\AppData\Local\xynJo\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\bob\raserver.exeC:\Users\Admin\AppData\Local\bob\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\R7AazwY\mblctr.exeC:\Users\Admin\AppData\Local\R7AazwY\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD566dcc48d05a7fb4930f9da682a7cd0f4
SHA18018924ef9185579e0bf63a17047fc3c98d308db
SHA2568aa46384c816d8be67a2c234419c8c9f129816c0724c2d9c3ddfc479f3f7ed2b
SHA512593baed5a4b2f659edcc305ad0428ae1b9051f1a850fa3636ad99dc2ca8cd34c621a6de26ab80451aeb797472e92f185e74dc88914bdb0dce7cd989ace8f55ba
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
1.2MB
MD58bc0d4886cb6df81b00ee131a64bd609
SHA142bf6c733a1b6df1f83a5b885dd41fe81dac7aa2
SHA256504b7277610bdc88a3b8e4eac673ed964b78a16e865c78d1d0957369118bfa44
SHA512d570ca3163744baca2cab8f43144807c302d374679e6f9d1dbb0574f7d5c47cfed494434c598b74bee5e43fd4fe2bd512845005c87297ee89c3a37452af20f2f
-
Filesize
1.2MB
MD5663e3b004241099925060936b16efb07
SHA1de4f677b1be4011385b6dde2337da1d94079a7d0
SHA25674422e3efd52f4f9f6d4f58f7b7402c3224850b67446dbdb0c1670f19a8d77f1
SHA512efb664e9baae84fbd36d5ffaf5457f4acbf7863f86c249aba067b5d8e710abf333ae7477ab930c7c947da50219539e980b5d658a5e00792e0b158fb076172080
-
Filesize
1KB
MD54ebbde9be5ec38c5514076dcefdeec66
SHA127c4f13e377537b8d4aad3c07aec717d0573761d
SHA256a6b25372e3137b72f6d076fdfd22a6c50c8a53551c854a6819cdc09df7ed015a
SHA512a56ce861fe3a19be86e6f42e151ae91b2750bcd1bf31c078b9873947178540ad7ba4b3e84435af9e5667cc6fcf534a08f7cbec278978cf760571a74aa6baf8aa
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB