Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
30-07-2024 01:41
General
-
Target
6d8bf02033dde545d05351f631980308_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
6d8bf02033dde545d05351f631980308
-
SHA1
e3c3e55f963bd4df788dccd21f11c8e0f6c33542
-
SHA256
81bfe8da0570d8f0bee3ac1e95c73ea4617601bb23c33d0e3431ea9e3db93baa
-
SHA512
76d35b440a86c108b038df0163a02481fae95d78e97aef3de74152e33e9f3ab04ffedb73639b400020f1f362daa28d256933ef121cb8d134cab46dc6ad675d3e
-
SSDEEP
24576:HuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NvE:p9cKrUqZWLAcUH
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6d8bf02033dde545d05351f631980308_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\RlBF\SoundRecorder.exeC:\Users\Admin\AppData\Local\RlBF\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\spLds\wscript.exeC:\Users\Admin\AppData\Local\spLds\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\Dap4vr\wextract.exeC:\Users\Admin\AppData\Local\Dap4vr\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD577ba87f3c41e515536ce1a5013bea7ca
SHA1789fc3ee27fd1a560b8fb498fe59b0d9b17ff93e
SHA2567dab7054767337311feaf11faac8744332e7d32e30f8b36fbc0210663c7d40f0
SHA512d2e1e3071aae8e254765c7f2f1c15a1ca18ecc7222b5799152c0a6c2f26153c0cfaee162c929b5fc569eea855d18c8fef6a538b2aa914047cfd8e8ac91a83038
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
1.2MB
MD534029dc98259532a2b92ae6e55efc339
SHA1372ed64d63685657de997e212a6ff5699912ef1a
SHA2567b45b3752b1f3bc84323c7f8797c6468af7c1c25e5eef762024045a2298b7c1a
SHA512e8d2381d235a6db58d9eac59d1a4f863c561192f11e1a5c8f99a4e739b16f999a48b02c31e0bbbd5da22750afe2acad69ad2c7519a2d9a6cd336e09af5f50579
-
Filesize
1.2MB
MD5b316ebd40ebcc30cf197958b22613c28
SHA16a80f0f41fb2c4d6dca7379313b613eac67470f5
SHA256a763c74f5fcc96a4c877fb8f04165091b49ecd78cdd46a9680f7319d76e0a868
SHA51278cab4f604bbb0f035bae23c01bdc0103180dde31526f8d0a9ae17fd656e86d86669e65936cdddc16d4f19b06d51086cc773c5e8b6d88c6013ddf1bb913441aa
-
Filesize
1KB
MD50e15caf9586b205655f5390411c03c64
SHA161e8163703e82d39fd538d38c658ff5233239aef
SHA256dcd3c44b32665e708e9dba11a99adff7f0d5f5ec701370f1e178ecb364764457
SHA512706ed4b5b9b410fdcdd110c7351b12edcd2b8a3bc1ab22d235882ba50687db7df9b33e7d0b6f6e2121b1a387da0b69dda4cff7d3a3556154761968b1abdcf7e5
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB