Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
30-07-2024 14:38
General
-
Target
74cac0f8595da4ae3dbbc1e923c8ce02_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
74cac0f8595da4ae3dbbc1e923c8ce02
-
SHA1
9d6e13762082cbee6a60eb76e4d5bbf48e5743f6
-
SHA256
5532880b11bd9338a1512bd6dc6b81a629d4022c15930ef5646f854b8599a9ad
-
SHA512
2166d74cef05f332ff43a4dc0dea9c2280405a4454e2c2a9ad4a7193cb1481c8beaa40e7c81b2b06b6af96d4cbd52f49d741911ff00c08d3108c5869a0c30346
-
SSDEEP
24576:JuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NR:b9cKrUqZWLAcUJ
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74cac0f8595da4ae3dbbc1e923c8ce02_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\zHNPQy\Dxpserver.exeC:\Users\Admin\AppData\Local\zHNPQy\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\6RW\eudcedit.exeC:\Users\Admin\AppData\Local\6RW\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\81MwsinR7\mspaint.exeC:\Users\Admin\AppData\Local\81MwsinR7\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
351KB
MD535e397d6ca8407b86d8a7972f0c90711
SHA16b39830003906ef82442522d22b80460c03f6082
SHA2561f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde
SHA51271b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e
-
Filesize
1.2MB
MD5a1520cb59fab21e6b59ab700e32f978c
SHA109d500e0b17a309dfcc72c298d2479b46d8ea327
SHA2564eeb09b035ddb8247c0f970bcf32cd6093e1ea5b12defbf23a83a819748c3efd
SHA512b83d47566c69ec4763a5961a0192e8c423e0504a2b71db5d5bf555cd934f426a4e8759d5fc575543d3a1281719ee998ab4fe91b8d9a7e95c416d07c019386cf1
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
892B
MD5f1d7f6fdfb2fe9e2f08ad1583ded3b29
SHA135225c82e06906b34377786e7a094998f3f89181
SHA256e99c5987d1abb9342c268f208f1db9a2eb3e9abf38fcd483a9064c78b1677843
SHA5122699d4b5c7190de95df913f93a90802fdd8bd9eaf08d56bb89c71a8cbee7998ad2b1ed960e66bd3aa187e7d0c667ff683a9e01bbccfc97c00fdc7e7864ab399c
-
Filesize
1.2MB
MD5eade623b69fee3f34101839673d8d487
SHA195aa122c996caba37ba1a66fea12693ba0c6693e
SHA256cff0da0ae5e67112a91a34b8f0ec1617db9dee69b3d1d752c61ebe2187e1d48a
SHA5129d526ab7c9c1c39ce764482b2ac823d40e6775a45e738635db0300990ff5f6a9643d54f58bd6b526ca799a29b266e8dec087aaf45634fc5e0a80a951f606ab89
-
Filesize
1.2MB
MD565a0e8954c61cb7c162599b702431f45
SHA1f4e55da137081ac0fb19a27a8c1beff03a869b0b
SHA2569ee376c18c78e79e157de20b6863bef30b78191a696bab477bfd4c2aa92cbd41
SHA51282859f6b049b615a82430f86243df04043b6ae164cfd24eac9ddc9e0cd500cab3d4cabd072fc5de314c006b2b0023f80b4ea2f08b38cb785cc46634d256a155f
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB