Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
29-07-2024 00:15
General
-
Target
2d49503d2bb2c8767fb1694130330e24_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2d49503d2bb2c8767fb1694130330e24
-
SHA1
b083e2e518dce9faf0c317b4080edac716f8a7d6
-
SHA256
0f7f2948cdd5729afb075981ca2d0fac509ac37886e1d0faec72fc52d12f7571
-
SHA512
f120f2949aa084e8c363880e3030bab186c2fc8504bb1813bc5e49fafa043d213cccb0b57454a7dd4d513c73eb3af5dd251f028c6327cb3e8a87bdff1953a309
-
SSDEEP
24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:X9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d49503d2bb2c8767fb1694130330e24_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\Tdzztivx\lpksetup.exeC:\Users\Admin\AppData\Local\Tdzztivx\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\NfLP\iexpress.exeC:\Users\Admin\AppData\Local\NfLP\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\R0msS\iexpress.exeC:\Users\Admin\AppData\Local\R0msS\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD526b92461ac71fa6165c4c3a82b7dd336
SHA13a07008b87e8cfbf6e694308c9e35f71edcb9812
SHA256f8d2aaffc147fb23f77a646edc433ec7c82b40f1fed9bcad6ee0dee6db57036d
SHA512caf01dffc6969cad1aeb55dc41471ae897281a447f594cd619cbc81c819c13432684875f4e7d609b2cc420704ad93d9b794866fbf43d29066f380f9b26b69d69
-
Filesize
1.2MB
MD5ac24fba4667bdab3571eddf3abb0846c
SHA1819c54a5b4d27edf83c21080aabb083ea1d2663f
SHA25686cd15494b62a0d1b28ec85cea0f72634280e0c8f96f6f499912ab07262b0449
SHA512851285f38969af469c6dca37101aa9528865981f5e883c3588effa6a6f32dabb7affe8da00317f2045f49dfdfb569c13fdad81b953fd35f6a2a4a99d181054d3
-
Filesize
638KB
MD550d28f3f8b7c17056520c80a29efe17c
SHA11b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA25671613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA51292bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861
-
Filesize
1.2MB
MD542ef0ca70d1019c5d9b5210e510b9a37
SHA139978bb5c294e85cae86277651de57ad1e830bf2
SHA2561372f90238e9e5fbdd293380d53ee58af5f39b5663bb0bac81d8968ac5c9eee2
SHA512ffe043cadd2e2e3922b048f144041fc3b9926538fa7dafd59f08a2c4f08408add5e35b08353c2b8e9df59ad4e95933938b742e1434fac17d6a03bfa72c34807c
-
Filesize
1KB
MD52a82807711e0c615549dc637f56fb9df
SHA174e254c6d6820b75cbde23c0423857e1c64f9e27
SHA256e1593ce8f6e756ca571282706fb3c5d22f1dee2c41efa9f8089e42c2b63892b3
SHA5125852c2bb33a480670cc94df74260c2e72407e0f48fe78dc822f0933bbe5f0f3623b6856dfcc8d8b956b498da55e5bd9c72c55b77a66a1388a8685641adce75ec
-
Filesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB