Analysis
-
max time kernel
108s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
30-07-2024 14:20
General
-
Target
73eb5182708f94d4d29563da6ccaccb9_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
73eb5182708f94d4d29563da6ccaccb9
-
SHA1
2dfcfa915d7877942745d3af43fe5d017a3fb0cc
-
SHA256
e27f783be3af08c4f00e2b4db7c18fe736c86979491b2fc1e849b1e5fcf97b63
-
SHA512
c959b398348a2514752d72a5fe7e8ff66ad19e577465efac1f03fe6861f22982f0af8e7e0e1e4639f7845b58fcbb1b45f42e55fb8af1a903f37691726ebc3071
-
SSDEEP
24576:tuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:n9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73eb5182708f94d4d29563da6ccaccb9_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\EABGu6feh\DWWIN.EXEC:\Users\Admin\AppData\Local\EABGu6feh\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\Bjn\PresentationSettings.exeC:\Users\Admin\AppData\Local\Bjn\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\fvgbc4\OptionalFeatures.exeC:\Users\Admin\AppData\Local\fvgbc4\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
Filesize
1.2MB
MD5aaf610cfd7b56f23c8ee721b8b8be304
SHA15d1bd2c2b43845bb9e5dfc423a3f4f03c445c1c0
SHA256de1e29cc835712698625b015b09453666f56cc0d0abb484a91717f9c525603e1
SHA51248d9a0d015dbe828cd47151f080e54ef5333fd7387dc99ae5dba33555e273dc21b09bf256c4643cdc151e27ed4532063f939719d2f6d4a7246a56e4e422c7e1a
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
1KB
MD569bb0439c6c0b22c4dc43799362007c6
SHA1fb07a20ac01a4bd6082d0045db5da9ce7b6f62bc
SHA256434bde576d08a4b73b308e8a45ebff5952bf99a8645d7e081adc76dfdef8c99d
SHA5123bef271aa0c9647b2422dcce87ca4fe740427d2137b15e9b539f1beecd0e58da265f468fef76827796531d39e3b7df8ce67c350e621cfdca1e10cf97d0430949
-
Filesize
1.2MB
MD56a9f0d99a843247002c79047409e0d08
SHA18653f656cba49cb24422b5c2cf6621aa69a4360b
SHA256b69bddf6503aca51a1ee7e893a451588dd32eef6bbeaa3f5a6d38d06051b76a4
SHA512f9b4e680276b6613bb55017c29a468279f17ba5f88a19821879a3d93f35efa26a5a8aa04e6ee9ce10f8477ba8fea041953014f6a518e29dab090b7e8f879c5c0
-
Filesize
1.2MB
MD5538854106b0591bbfb6d652b34762ee2
SHA190368de14e2a60f5fbaf3fe1bf5ed25f80533175
SHA256bc7cc53b049575238be1d4722afaa1d4a5e29d312050c6868730584563e90461
SHA512b47d4a18318c951f77db3094b9f3f108f5b609a7269db025590875d30496b3abe30e3905f70e4386abf25205774b9e86cc67a2ceabca4f34d8f1fcfefd36e5c6
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB