Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
29-07-2024 01:11
General
-
Target
2fd82133005480e6e2d63dc37d378b35_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2fd82133005480e6e2d63dc37d378b35
-
SHA1
3b1e29f059c924bb0fd7186be4752c3dcfc8590c
-
SHA256
df363cbf7ba7d2239bdc9e4ea6d89bc8dd24cae14179679808b08bd945cc40cc
-
SHA512
d6b354724a91101e94f3c136b0b45f328d9e03176821b04ae1ebb49f0a603eb70505fc35e9a69a4cd867bf8b31015a229906b050ed0d55bdde1ea0c308ab77bb
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd82133005480e6e2d63dc37d378b35_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\JLT2t1T8\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\JLT2t1T8\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\B0lAS\wscript.exeC:\Users\Admin\AppData\Local\B0lAS\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\WVhFSp\p2phost.exeC:\Users\Admin\AppData\Local\WVhFSp\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD51730fb658b2946bc06f3bb03af329b07
SHA1072aeac1d0fde64f01c354d60e0e227a8da5b84a
SHA256023a325915a3a42857de30c55fc3d58f2bdef6e2db69e60043a9fe6acb9f481d
SHA512d7a38e8c01af579c493ae19b4095f7f63df2823e592ada31fe6e17ce05420e06c237c8ad6b21ed9e476d20a0f412b4c789a3f6a9585cc7f31cf0e170ce28f754
-
Filesize
1.2MB
MD5f616b6242d7ad8c2527faec963811590
SHA1d09e41d6dd125023806ceb66d529cae2c77f7a63
SHA2564907f30a4e0e081916c95505a22a125ddd0e6529eea5475626c2480272f393ca
SHA512c6bfc5aa4bf586b1331c208e4e2416fddd7cbeb951ee8aa3b22a6c98b1064004c004df6559c0e32897338d6c2aa26b7c6ac66b4f821aad95812a54d00f28f349
-
Filesize
1.2MB
MD56f7b2684a153f7443a7bb5232b278141
SHA1043396135e40efb7da445b4626c569e7f0fc12b9
SHA2560b5dee48b41098f4c5fa353ac96578ea03934b8c1fb42b36f5908a21fcfecb49
SHA512e347513ad3df78d2325386f1988222b4901397dd54240387a1b3e5869ecce891ca7b426118bcdb8ffe7166c5fcef991df3df010879657ebaab2120a8f6536b63
-
Filesize
1KB
MD58f53250fdc4c852acdc0a0ea980af26f
SHA1bc0a446bf5d75bf44a9d62d22e4141cdf32ecfc4
SHA256fb456c04834c789bc41faa956303c225eba691c095ee9f9875d0170d7c37d7a8
SHA512f41b0fb3f324c687351c027465f859f42ad809361b07af5086e3a5bb07079b41e56c65f6b90d1eb6e414b55a72fe07ed4c93ccd757b9c89cd008f7719c9fdeb9
-
Filesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
176KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB