Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
29-07-2024 05:24
General
-
Target
3985eb89d1fd86b34237dd652791e711_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
3985eb89d1fd86b34237dd652791e711
-
SHA1
8d9e62ae446b92a2e000ba48049db40bc42826d9
-
SHA256
9c8c275de7475ec92078de7d256ba88876564bc544414f73adcaae45b72750c1
-
SHA512
ca6712691481ba69bad62c3921d4fd69748cb2f24470f53d9d4ebad7ae6971c1d8f1e2baaafa93bbb9b57d5646f82e3f37ba65b1dd3fc7fe2b91914b5af1ce90
-
SSDEEP
24576:ZuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:L9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3985eb89d1fd86b34237dd652791e711_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\VNKyi\rrinstaller.exeC:\Users\Admin\AppData\Local\VNKyi\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\YBth\sigverif.exeC:\Users\Admin\AppData\Local\YBth\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\0TONuhu\SoundRecorder.exeC:\Users\Admin\AppData\Local\0TONuhu\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
1.2MB
MD5e1eaa19f6a1342a97b4e61319fe445b0
SHA12fd8f9587a1e06ecb22987a113077b0ffd9a777d
SHA2564b8407d1c66256d93402b2277a414355c3e50ce1faf4b26bd081ac2c1be53cdf
SHA5128636290adefa5c3171774023c2a60860ff53ce7cc64e03c68cb486f2d328fd3a5817264bb012c832fc33ac9ad7a2a82e8efec977b6ea43952f632ea6c61b4549
-
Filesize
1.2MB
MD53c93eab0b45a0be33c1f75a72981b134
SHA1b02515c1ef734c3d9e5838afcb9f14c067174956
SHA2561ba3a683155915f35516365512ee6303d78ea0db9305845c916674b86c40c1b1
SHA512980b3f8996c8f22711588a67d6622c6390525841030835f0e77f8fddbf0b6b301ca88b1a8341fe2f6aa32e8a412d70777d8f06ff3193771ec87415294f7be956
-
Filesize
1.2MB
MD5d9d399e560a084a5c99350840efaa149
SHA1517bd60f9a37421f4e27af465de29c7c826c16a9
SHA2561877528e8a745d7253575f79023164cd526bd2047a036aec91dee9cd07a7c359
SHA5123c344440a2cc26d4e5daefba44d6114ab040e076916caae137969a97d9008dbf3cdeb0b60fe291d3b4641b129817612e068544ec3afd4f961e7f9919ee399d0a
-
Filesize
1KB
MD5ff3e56452fcf608a727d94aea14b886f
SHA186300f1fc3a11212804ba4ffb6d1a1a7ab953603
SHA256d25f81b6c0294fd3149495af087df748ada4d217c42536a9d0ac22c361832526
SHA5128c044ae8fbc66cbeb80976d919bbd100deca7d83a4b2c26aecba0961fe066b09c4cb2154bebb568a7480010b1c3c9ae425a131ef55b8116768c8c88803845c9b
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
73KB
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB