Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29-07-2024 02:04
General
-
Target
32537f50522e3740a5c02b2b70095c69_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
32537f50522e3740a5c02b2b70095c69
-
SHA1
33c1010b9daea842501a2c4c854d4084d726880d
-
SHA256
5f25e058ec1e4e713a06af4af810eaeee84640b5b6a3995d8bb384e06e958f74
-
SHA512
660606f2c7cd54ae91a1be2fcbd41d52472ca3ac97880aefffa178b02f1c14df18a901b02267cfb58cfa441f123617f353ca7ce6d7c3b61daef5afb150d5b1e1
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NF:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32537f50522e3740a5c02b2b70095c69_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\ZSf4s\xpsrchvw.exeC:\Users\Admin\AppData\Local\ZSf4s\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\elph5umW\shrpubw.exeC:\Users\Admin\AppData\Local\elph5umW\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\fveprompt.exeC:\Windows\system32\fveprompt.exe1⤵
-
C:\Users\Admin\AppData\Local\aAnwkob\fveprompt.exeC:\Users\Admin\AppData\Local\aAnwkob\fveprompt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5de575dba9858b5951b079ce606592700
SHA1aa610292d475a6f2a7733e3ec54ad1b3858b1376
SHA25672fa74d5cd405800bfc69980686e8cbffcaa2f39fb8994fd9ad2cf17af37ca94
SHA5124ff195594a916453633237ac634a1bb6043a280741abd6d49c00ab30ede131067259983e456ba41d2cf88f06c2f7e8d6f0ba468930d2db148233f84f20b7d5eb
-
Filesize
1.4MB
MD59ab2e6f6a9ac7f1d3d92f4b0f3e5c2a3
SHA1349b00b3cdafe85475e9187af18c85e9c4bb72c0
SHA256ab3a74305b81e0a449ace70001ca11e6003a24a195ce62e53567093bd573ac42
SHA512e45af70639694332b90f6b892ee614a496eeec3c19acf5f45e0d3c4946b1491e39a92646d3046af9e990d9aebec50dd718d8dc015ccb5bf8b6cfe55055cfc535
-
Filesize
1.4MB
MD5162a0c445fe56de299dbe4d41278c54c
SHA12434728ddf7c5024c6df57534e4e095e3259a7be
SHA25637d38458a2567e3fc02ef6adf7d65e4b0983954a059f914e39b40ed7c297cd83
SHA512e7cf292028aa043512bbfe132935dbe3dcf6d9a25524576600b41a47360a72bacc63d44ab5ac9e6cb10186d127d3c68b2c61bd30d7ce0d420d8ec8017af4088f
-
Filesize
1KB
MD5e700d9db785aa9018cb767a0bff43064
SHA148a49fc40e03902a892fee586335763f7b29130b
SHA25680fd61817c53d5a9354599a69e3d28e8f02371a67384b373c332191104580807
SHA512857556bb18f21427f0435459865488a20d04ea0e02239f1cc2b6c80d651e67bb05746dfd71669a8e05a5ad87fefb8249121038328353051b97650bfd91e867a9
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
104KB
MD5dc2c44a23b2cd52bd53accf389ae14b2
SHA1e36c7b6f328aa2ab2f52478169c52c1916f04b5f
SHA2567f5b19f2c6a94833196ee1929d48094889b33b504d73d3af88dd857ceaf67921
SHA512ff083f74777a9cfc940d4e0cb55886397e27c85f867de9a5dd9ea2c2751d2a77bf75fe0734e424d9678c83e927788d07d0b3072024f7e5a9848c7ff1aa4090dc
-
Filesize
398KB
MD529e6d0016611c8f948db5ea71372f76c
SHA101d007a01020370709cd6580717f9ace049647e8
SHA25653c868882ebc9e0d4f703afeccb172043069ccc0b5b6f7cac1d2aad9c4640930
SHA512300216ab47ee44b8f68d4835bf26641f949039522b680af00fb602f57d31c38812428dc624461bc2cc7d6384cad396bc033718e41e11a65f7dd0eeb36ed924e4
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB