Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
30-07-2024 01:25
General
-
Target
6ce1bc42dba1e06a071f724f691f5696_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
6ce1bc42dba1e06a071f724f691f5696
-
SHA1
af88a5c242b101fb94bcda6f8e65ae1a159a65be
-
SHA256
a1b778d340f60f244bc8030323206caef7b22f10df2861b1f330900c6decbdb9
-
SHA512
67c8d1bc9c61f2d0def951e8e4e60f36a796f80b772353bb5e077f403e618a83abaa80ec7679e961bd767b435254140c9433eeb744169e898da5b2b563d982b6
-
SSDEEP
24576:iuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:q9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ce1bc42dba1e06a071f724f691f5696_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\CoPCZ0jOR\tabcal.exeC:\Users\Admin\AppData\Local\CoPCZ0jOR\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\bRnOWl\OptionalFeatures.exeC:\Users\Admin\AppData\Local\bRnOWl\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpnsvr.exeC:\Windows\system32\dpnsvr.exe1⤵
-
C:\Users\Admin\AppData\Local\1yQnf\dpnsvr.exeC:\Users\Admin\AppData\Local\1yQnf\dpnsvr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a74394bdc6409984f0f750a2f4eea61d
SHA132edd486105151b0e4a6ea2fcf5bf010ac2b560b
SHA25663b21ff37edb7d35deea9541323c8d1335c53c41f97950d562fae786d0511c3b
SHA512894851cb26faedf6ed911fa236fa5881296a265dfb7a52df54bdeb54c3d7575f7a5d23e33058d48494a1d6ca0950762f7aad7278b748aad5218740179b5ce3fa
-
Filesize
1.2MB
MD5970d14ae65b346de3e429daa313da6ed
SHA1e21f7844e12bfe5d0db846a5eb6d6ee2e38a26b3
SHA25660a8ab2544baec675e51fa9ad82e376abdd82060297f00c66a6b7023805d308a
SHA5121dea2c6812370acaa9112b33cdb92ac7f6e35384dfba22a76070404fe2a17eeafebaf0c63e49f20c7e8a0cfed6a49ab172755a6aeb0dc34ea7841f947709923c
-
Filesize
1.2MB
MD5b5849059e5713b99505af7f6dc48cc6f
SHA115bc6af2aa492e3db1879064d40b2f1b9c82ae3e
SHA2568bcc5c74309cf6366703afee4c402d1665e77234c38ac824b0e43b2c71aa312c
SHA5121c0de5327c037ea25c9978934ebbd99cebcafeeff87c2a00aa9f4bbec4710e06a1fcd2e88543ebe9050c6d9edc2cff8e0ab98916bacf5d3e54b5886d62e87c38
-
Filesize
1KB
MD5e0a1fd9089e4e0a3e6b94a7855241c84
SHA10031677df3a66ff3e305f0149a84134b143806d4
SHA25612d361957444768033e3f24c83eb376bc7ec14cf5aeaaa04a6b83770bd47ee42
SHA51203ace7b14933823159e60f8f7783ce9f0d2d2759bfcaeb6d0e18fa25d31707c686686a02cbc1aef0cb65ec031ae896db53e7dc25490d5d3d36c73522ed998344
-
Filesize
33KB
MD56806b72978f6bd27aef57899be68b93b
SHA1713c246d0b0b8dcc298afaed4f62aed82789951c
SHA2563485ee4159c5f9e4ed9dd06e668d1e04148154ff40327a9ccb591e8c5a79958c
SHA51243c942358b2e949751149ecc4be5ff6cb0634957ff1128ad5e6051e83379fb5643100cae2f6ef3eaf36aff016063c150e93297aa866e780d0e4d51656a251c7b
-
Filesize
77KB
MD598e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB