Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29-07-2024 00:48
General
-
Target
2eba1f3e3c4d522681391430b61ebf5e_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2eba1f3e3c4d522681391430b61ebf5e
-
SHA1
fa261d032dff878e2b05185a88ff061f2ad8cc79
-
SHA256
3b2d01d04f1d9eac4c480c16befd364cdd797febe47b96ad4a78380af63cf33f
-
SHA512
e35975deb8ec44d47cff6ca13407511b8dca41706069ab975c28e8f606c62b908e7e6c8298e0e975a4cb4f816f4314de895e6065eea819351384e6023227bf33
-
SSDEEP
24576:2uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:29cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2eba1f3e3c4d522681391430b61ebf5e_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\cqg\winlogon.exeC:\Users\Admin\AppData\Local\cqg\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\MCh1\mspaint.exeC:\Users\Admin\AppData\Local\MCh1\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\Ty7X\unregmp2.exeC:\Users\Admin\AppData\Local\Ty7X\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD51c008502759e05f8f6b26732e843f14c
SHA1b2c89895fa0e02862274d4bd8c3869a7002b24dc
SHA256afb3f83a249aea60170acdd6f918e0fc8de6747e097d114eb813718b9e8921b0
SHA512dce5c0587114246577fe36e9f6bb60097a821965116c51e86f8805d4f4db185c66087c8173b7dd2602e5902f435a4126ce4b818a14bb54fbbb1ec750ec37c027
-
Filesize
1.2MB
MD5db9fb5e41b6ca24e9159cfbf21a451ff
SHA14b6c3ad6c073b6e53ae21734ccfc439bb53f1b6e
SHA256456c1fc89fb5b6a51875013ab0d588db68f7f4df2df83b36dbe524e2a0657825
SHA512cd4fbc58c47a5623b0cb61ccba856346f16b61ee6a174004ee3d2aca930531e8c257349cc2918f760347f9faf17896ea032f6a904e08a4d3ceeda5737cd11182
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
1KB
MD515b9e2114a15bc9b00019d0231010de7
SHA1ebeb3634333d34b8491f49874da4c4d5baa123d6
SHA256cfb15bb7c44255155671681ca4283c8e0627696d2ef5b07650df47c04970a147
SHA512b6046e3ac87a36b20d016b8a83e1a5ade92ab7fb82c2ab0f74dec0508b10d159327b5007d15fc6d82ccb6cabad49138c35c80955f96d51ec5df666df1c5c957d
-
Filesize
1.2MB
MD5da65de0ede793e30c8b90bc145a5317f
SHA1bb6aa7ae5f5fadf4797a1a4a3c94d9cbc96293fa
SHA2568b6a006580ec7297ae37a69d37bd2ea0bb78c1ade027fca77c0e191a51b86155
SHA512c3e48602d95baa597f06c831decb1a6f362df6b066e8dd59e1215400fde0798b1a074f15ab6a9d786c8fa71c2f9542a3509a4061f92f265e775a91a92ca2312c
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB