Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28-07-2024 10:29
General
-
Target
14bd37f5d3223dc8f0020dbbadbb42b7_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
14bd37f5d3223dc8f0020dbbadbb42b7
-
SHA1
5a2c292ed148afccce224275633d56e602cc458a
-
SHA256
9da5bd994dc18b71c846a1f0b17dcd2c12e40210966e5d8ea4b7fa22b2da8cb1
-
SHA512
b8d3dd1404cf153dc70ff13c4a308e288997991df2912e1261c69c006ab4d63143989922366d20eed846482de5d6a6209b6b3b2fe25e7ab3cdce85b48c406282
-
SSDEEP
24576:CuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:K9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14bd37f5d3223dc8f0020dbbadbb42b7_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\C8zTegjMO\mmc.exeC:\Users\Admin\AppData\Local\C8zTegjMO\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\Imuho0\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\Imuho0\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\ElP\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\ElP\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD59a8ff42038b47f388ca4f3f4fa559d4d
SHA1ef2c62d5444b0902ebc542fbf1c35857717ffd43
SHA256d2fc59157542dc25c36f04d5e1caa70a52f48ab89b3b0a64732e0c2e2f08c653
SHA5126ab871d26766cf9f9ee2f755448c3e5d7b5f3db5e2667a92e8cc6f3257098edfa8ea7a0c2f85260e7956a2720721c4ce5960b15be867c8a8c807df931af9e39c
-
Filesize
1.2MB
MD5a53a95e40370d25773600ef2db5da531
SHA160c3782b1dd93eaed149586c120eadb3d90acf23
SHA256f6ff60a892db41f67fffb54bc966380c6c34fea3f8d59a2ab571059a24332d3a
SHA512dec0fb99905fbf9195939effce4b1b5c64ab333db1e1ae05d0cb1e9f36deb77c35d560eb725c2099914d897859a49db8b1e42e6e8a6c2076691988775c859da8
-
Filesize
1.2MB
MD57ce4d36280c693e0f0dd0fab1c8734f6
SHA1750d345d8d5ad113d2fe8e9a015122caabfd7f8a
SHA256ebe43fdbb298efd748afa327076c4a5ec0eb31c1581c8ef8dda0bf274e22a84b
SHA512180693e9a88c3e64eb679aa9db667a3f5fbe325d14918e9d3fab52f658cdbbbf12c6baf2222d6e296fcf814e4502149d936ad454ff526ae87dc5a15fcf21d113
-
Filesize
1KB
MD53d778e8952e27aa652a4599a0757cc7b
SHA16054fd6cd68afc481d48a2bbe15f6894e63577e4
SHA25609b12bfd367e2ef2cbe3d81235ebdf316e37dd1391b18b36f95f9ccc7f504398
SHA512ac1ca1014a1c8e94c51b24905f1ab0036a4577d036afeebb08b0645f6e118702f2c82be3f1600cd484982e1159af13634e7cdb116c7f0de0ed80abc2ea12ed6d
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
73KB
MD59728725678f32e84575e0cd2d2c58e9b
SHA1dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c
SHA256d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544
SHA512a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB