Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28-07-2024 21:17
General
-
Target
246baf200fe0776877875b48895018aa_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
246baf200fe0776877875b48895018aa
-
SHA1
4305c8cdb722247ffebfea9f06b9233339a606f9
-
SHA256
f73f90888a503e9599d2845337707f5d38ac1585fade9bd3eff224e65cbaa340
-
SHA512
78947ad93fc4cecb64f9351531519bd04c41f8ddf73cbd1ad3de58ccb027b646f9cff9cdcd438260271c076ae01c846cdecd5c0950b706df597ac88b39ada54c
-
SSDEEP
24576:kuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:89cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\246baf200fe0776877875b48895018aa_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\fpGwn\tcmsetup.exeC:\Users\Admin\AppData\Local\fpGwn\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\54Z0R\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\54Z0R\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\ZRqQ\winlogon.exeC:\Users\Admin\AppData\Local\ZRqQ\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c5e59b765aa3799f35efb128d9494af2
SHA11f423686678edbfff5232182041303eae4dbda29
SHA256573eb3ca218858784cde96e7b4a0440b22ad94b035f7d5ef673d268d73e72f33
SHA512d7bf5831d32848e52aebbc75e52e4198b397f8e4e4f1b1d9e88e61ec84176e8d6c9794f15d8936cbfe44bf27dff8cb2084af2ed487ce0fb18ed449e3034f4076
-
Filesize
1.2MB
MD5606410d79111b9c6657ef1421be88ccc
SHA1dad5cb501b7826abe3f2e8830471c19cc1399573
SHA2562e3726a03b37e46860f9e1e8475e7b20db6f85633aa9cd908d6a5b22d94f3a00
SHA512412d393b75f089a271fd9152d93b043a9c11d26e6f6771175fe595f217abef80ef4fff1f4159e6dda24e0423ecc574acd8fa9172e13d62df86cdbc6d34aa1c1e
-
Filesize
1.2MB
MD529b01f5434c995ea5caaa3f0e6e90f40
SHA1ee37bb3f846073ed494942f834c4ad583fe9d31b
SHA25609ccc7d767d35c25eecf01534d272ae97e51a90a3ceec2328a5f01948e4e01ef
SHA512bab2d9000880182e232b376d564388521e916360790e207b27bc9b3918947689c65d78403f8b504235feef6c94d2d9333efc5ef8ad7aec271a02c84ad4ffd3c9
-
Filesize
1024B
MD5ef9dcdb238cf9358561be08dcd0196c2
SHA19ae7e5a6b3beb89ca0476f0000c0fbfe924d2c8a
SHA256ca59b4800ca2c9d71ec566f404863ee875f4c66d75378156803aab2810eddd22
SHA512e72564a292b6d2f0f3eeec134c0d343042e412d06266139b316fa9f93b696ab76ec1f90fa7a0c37aba4a76c429d0c9552cbd74b9738cbbab6b6842bcf9a30b04
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
15KB
MD50b08315da0da7f9f472fbab510bfe7b8
SHA133ba48fd980216becc532466a5ff8476bec0b31c
SHA256e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7
SHA512c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB