Analysis
-
max time kernel
129s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
30-07-2024 14:01
General
-
Target
72fb9a4545e473d7d94fe766e6654729_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
72fb9a4545e473d7d94fe766e6654729
-
SHA1
eaffdc1dc71421e6f523456e2ecf7fd0ae60b2f2
-
SHA256
9098e782f34228349487ef9250a37c00874cb70ef152d48ac89125ad23c899fc
-
SHA512
740ab9c74701d3c280354c596e458fa05e795527c9bf522f87949abf13602db822e485f639c89d0a9996bfcb5782aa30040afcd75a9ac51c64ad2b2c349802c9
-
SSDEEP
24576:juYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:N9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72fb9a4545e473d7d94fe766e6654729_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\gzsGxb\SndVol.exeC:\Users\Admin\AppData\Local\gzsGxb\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\pNX\ComputerDefaults.exeC:\Users\Admin\AppData\Local\pNX\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\7Qgp2ljnP\WFS.exeC:\Users\Admin\AppData\Local\7Qgp2ljnP\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
951KB
MD5a943d670747778c7597987a4b5b9a679
SHA1c48b760ff9762205386563b93e8884352645ef40
SHA2561a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610
SHA5123d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934
-
Filesize
267KB
MD5c3489639ec8e181044f6c6bfd3d01ac9
SHA1e057c90b675a6da19596b0ac458c25d7440b7869
SHA256a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103
SHA51263b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
1KB
MD5b13f34b824123e371dbb5b3b965509ea
SHA1421a9653804c2e66663d39866fffefff3a15efb2
SHA256f25fab4a1b259af5c0c46018e7cb73758ac79af53cc5be1be768a789602b4dc5
SHA512d92f5075c71868ebfd8c0bd7ea7e6ece51387a18f133a7c918503bc42883410cc702076de54262d0f632c12fa44bf0273e295498edbe689cc0b15904c5609a88
-
Filesize
1.2MB
MD5a8f1d5b95d1674b9d1aef05cc6fc9ed4
SHA162d7b022b5d66ac547ddc8d49a6ff4b6504bf3ca
SHA2563d5107c01db3fade830b30e626cb6691cf49aeffa473af2e0270b1f3d92ae2e2
SHA512a636f96918bb109b7f4b48bfe3c4d6a3b3a801d260b6a9c4d74bcb0ad4d579d20ad2fb9f1c0bf013cb4c3c53f35778dd13535372e3b75b08110a001deae2a439
-
Filesize
1.2MB
MD5248063bd4c6262a3db49997b02f24f8c
SHA1cd234d9c96b4c6fd7221af5442e6d5e7adfbf098
SHA256b63036a18a4a6922714c9c1636b1b8acc2378120c986433ea0bdbd513c5f9e68
SHA512cb14a94be9a2fdd4f28ccef594eb16b5812fb2a7517519bc8eaf0af4935e0c0a870652f692a5a006e069a8bd588b5428398efc22476560394396b11f49046437
-
Filesize
1.2MB
MD5db2041837bd104bc4d8bb73d9fbd4618
SHA1be7466a012437613a0561b9d294e516aa05597b1
SHA256f0686a464f4c8f8cc642769f0f9a97913dfd7f27ef917f456601479858303e97
SHA512a489ea51a39dabf0997e6feb8dbe11bcca5d405eba64b251984a020a526354cc181879d7635eafcb5888400b1d214f04e46d1aa16bacf41edde90510d387305f
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB