Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
30-07-2024 01:28
General
-
Target
6d024b9363b39a0acd1de39d9e8e25dc_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
6d024b9363b39a0acd1de39d9e8e25dc
-
SHA1
abcfbed32e6c09c582051971904f85a8b88bbb5a
-
SHA256
484d7dea43a0c0e76df55b04cb19202f7fb13e23ed41cbd7746cabcd90a1c5c2
-
SHA512
984397e85bba6831163f155bf27a50956ed69d22fde69186bb9c74f1a76d12ea09cc01528d3bc9364fa3a8629eb2a838ddd65049f97cd1305ef0b8451c7a5389
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6d024b9363b39a0acd1de39d9e8e25dc_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\U8y9NIhR\notepad.exeC:\Users\Admin\AppData\Local\U8y9NIhR\notepad.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\MioJN\sdclt.exeC:\Users\Admin\AppData\Local\MioJN\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\cEuFk4\spreview.exeC:\Users\Admin\AppData\Local\cEuFk4\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5051ceda9339e3d19831f187ff0613476
SHA18dc4ea9f97010b1450fc641e09f336dbe367222d
SHA256b4b16094bb8fff1752bdaab9d15bf00f91cc3218929fd5d9a6363014c580d049
SHA512438305e16eae9c89dfd161f58ce3e93dea87accbc29fec12c0c67136d10be3b0e6e9e4937d13a05bd230fa084426b1168de5b2463bc1d59c70dc8168295affb2
-
Filesize
1.2MB
MD5f5e5262e01785d21990ce164f70ecf04
SHA112b3f60a45a3b5e2f1c5867f8c94fe1781c071da
SHA256e711fbbd677203e5f9ff4fd90787466b73866d3b9942f8e89211e7e26aea4166
SHA512cf7c9b001561b75431ac83e912408a6b2f37ce76122df898ebc467e531db31f77de003690ce58ac134d1d542ca0325f98226d863a17cdc6b0d57354e509d0caa
-
Filesize
1.2MB
MD549c092387ffeb39934f1348054deac40
SHA1a3a866a6a2c146ca667b84ac62ce018f7a1cdc20
SHA256e83b2686f0ce7c76c2d7dd84cf4fe3d4c4b4f758695a34be0737949e690c3662
SHA5128e8125a5c87690503d2254e02a058903c1ce33b9d52bcbed8fc387535562fad3dae7833980945c0fe6605abb54fd88e7ff8489155e0aaa9ae3323e3cb50511b8
-
Filesize
1KB
MD5fd24f8e173b38241f19f60d5e2e73be8
SHA1ef52d39932c089add31dfcb09bbe1cbe07cb3c2a
SHA25601a76f59dac69cfbeb738d5a73c13e21c3463ed7ddd5f7fcb072e15dba2a8527
SHA5120defaf0fe226f263f5dfcd5e78f87442694f9180f464371ffb516dd1bea2c94ed6a2cb94d59d058f5ccef78fd0aca76f5f85e5041998206559780cb492141dfa
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
189KB
MD5f2c7bb8acc97f92e987a2d4087d021b1
SHA17eb0139d2175739b3ccb0d1110067820be6abd29
SHA256142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2
SHA5122f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB