Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
29-07-2024 03:00
General
-
Target
34b5a5e26c1fc9cb86f772e8984ef966_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
34b5a5e26c1fc9cb86f772e8984ef966
-
SHA1
04c065da296af65d4d6217a984494239127ca651
-
SHA256
3e6d8d1cbcc0301f55df11d1ed8889cd73920d683488f95bfaaef68cc795e2fe
-
SHA512
b8ee5e509d1091a99b2f2b8523b3203f236d2ccc68a3be13b297018ab17c9c53bfc12b19888d096a15ce4dd6812a8177180d94c4b16bd71cc0320e918b37edaf
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nxt:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\34b5a5e26c1fc9cb86f772e8984ef966_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\Ppw\mstsc.exeC:\Users\Admin\AppData\Local\Ppw\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\HxzHcW\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\HxzHcW\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\icardagt.exeC:\Windows\system32\icardagt.exe1⤵
-
C:\Users\Admin\AppData\Local\6Tpbsk4q\icardagt.exeC:\Users\Admin\AppData\Local\6Tpbsk4q\icardagt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c7cc560bd6b7b5d1c5e0962aa767240e
SHA1aa43b83b3f916e5379f68ba934f10d94da2a06e2
SHA256ec473216020f0289e2e246b532b355cafb064fdf515d3bebe6e69414d8332b8d
SHA512d42014f5e4189f342208430c42ee595eb63cba659d3fdae71b75cbdf19ea00790d75e245553e6775e41d01a1df2c185bbe2d5fbb5b31179b1bff4fcf24070af3
-
Filesize
1.2MB
MD5d3967b84dba50e12d549046a520ae27d
SHA1000cbacc1cefd25fcf378d25de7de58dfd5d71d0
SHA25644ade4aae7f28ac36675d51e72a4eb15cd1d01575dd56d8335a0d8a25defcb2b
SHA512faa48a891fbe144959db0231fe6ec8db83aff63f36f0d028787129b8f0e5c0a4f1bf190e2c5aad8c0a50566570ed069517c46e7d1db7245089ea0fd33ce77176
-
Filesize
1KB
MD5566469174f4168779a60bcfae4ab135a
SHA14a70309ca2538b3b09741aee529a938565cc7d26
SHA25662981836d4ebb1b2b4d77737a2699a4acdd27f0fd99eeeca93636c73a76c58b9
SHA512c20437c6de4a242c0fa13ffd62efbcb44cc02b7c6a30991c55b4319f88c26561f042bdf1e319391133b44bce45c442037b92bf4befdf8cb89345f9046fc33039
-
Filesize
1.2MB
MD578c217c7a6fd77546bd259ee0c2df349
SHA130b77183d8f5e1bc0f0add228e117756ac52dbbb
SHA25640043fdb96b37102ae0db191c300cadd9f4d109638fff538ab2290d7de4799a7
SHA5128f6807b654916b5ce8b21b74db20445c77b9669aad4b3bea1ff2b0a759bc1dcfb7cf90013ecfd12d17f17952cdf48f8a8f33992a823fd2f44a245c96a8364e28
-
Filesize
1.3MB
MD52fe97a3052e847190a9775431292a3a3
SHA143edc451ac97365600391fa4af15476a30423ff6
SHA256473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
SHA51293ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
1.1MB
MD550f739538ef014b2e7ec59431749d838
SHA1b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA25685c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA51202e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB