Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
29-07-2024 02:35
General
-
Target
33a896d6184851ee490f07f6ef499b73_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
33a896d6184851ee490f07f6ef499b73
-
SHA1
fa9db1c9c6256ae0dbbb02593ca853df3f31f171
-
SHA256
184451839f912dfa47548af44b5f0c8a62e084a23abe992b3cd301208c190823
-
SHA512
1140bde17fe9f76a65b51960526d6d0b2db68a031c1e55689ce2369406f1436f3028f7154119b154516a576a3298ff7efd8e8d46af491647cd0c4e2f88d8319e
-
SSDEEP
24576:3uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:59cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33a896d6184851ee490f07f6ef499b73_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\javaws.exeC:\Windows\system32\javaws.exe1⤵
-
C:\Users\Admin\AppData\Local\jxW6eQ\javaws.exeC:\Users\Admin\AppData\Local\jxW6eQ\javaws.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\5cbI\msra.exeC:\Users\Admin\AppData\Local\5cbI\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\O1B31PY\lpksetup.exeC:\Users\Admin\AppData\Local\O1B31PY\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e76105127b584e5739e37059f05eecc4
SHA1ca47732dc3e32100e24b39163744085a5f91c8c5
SHA2564bdeea6c19485697b25b5891f88083ac71a2e41f9b371464863f3cda5542c232
SHA512e1e0082d0f0e5623a7707774d264e9b8117993e429217c3d822b968d1ce1d2035dd70cb66c8c75fd228da04cadc28726698c041651fd632ae03c13e645481bd9
-
Filesize
1.2MB
MD596a01bbf39a04f7f6d8cd077d3e272d0
SHA1c1905622a18210172e78b2615a618249f48be721
SHA25683018d12d1e6bc9dae3709b7112906688ad0014f67770ab5d97b04a4d0053ebc
SHA5128167346f2713d1a954894b04f00aaede37a2de8a0b334995f6ac216b906a683133a8728dd74332d43f09834fa04b1ce73165917d866c56b9388902c080530f7c
-
Filesize
1.2MB
MD52d7db3b26f091fb059e9a8196daf364d
SHA1d079f09e8dd2ba69c2c08f94d140b5261088bb8b
SHA25696a6ffc9b81a6c147ad3a977d61add2c7ef06d86bf62686290946be2499a8e61
SHA512d43630ef4707e97e2b6ead92ef4559cbd56f346fd961b42ad283d7f149880fcc9ca1e0a85e865efb562963c05146e68d4a485b8e97b2eeddd2e51287c73625d2
-
Filesize
1KB
MD5bc8524720d9314216e978c028b500abe
SHA1e3634ae85e23f8068d05c318ed5ba6ca2fffe7c1
SHA256a4f86ee75754b536518cf7f57f45dc0f15848405e7db4532d1bda94996fcf19f
SHA5124ab6e4eeb4e0adaf4422839039dbfdf7037034899f6e792a87a0492ec2b4d37d1457fca1d820d51d2883ba121b38a5e434b2e439e34f58cf4b75788ed260fee3
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
638KB
MD550d28f3f8b7c17056520c80a29efe17c
SHA11b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA25671613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA51292bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861
-
Filesize
312KB
MD5f94bc1a70c942621c4279236df284e04
SHA18f46d89c7db415a7f48ccd638963028f63df4e4f
SHA256be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c
SHA51260edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB