Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
30-07-2024 15:40
General
-
Target
7800b9d0be9bce9e13706e9a738321cc_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7800b9d0be9bce9e13706e9a738321cc
-
SHA1
6e4efb0b9602f6400ae735dc734f94faeeaede35
-
SHA256
d2f5888941801c183beb9683356f780eaf0b66a94b595a8db0a52b32db5034d1
-
SHA512
dbb62a792651abc3f2a5d2a689f52c58eebdd7c6f448d2f10579f961f6691ef3e37079afe81dd52580cbd2aa2bb02228a06240d8aca4e83667c66c1e6007c68a
-
SSDEEP
24576:HuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NXwF:p9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7800b9d0be9bce9e13706e9a738321cc_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\e0bbIfNJI\BitLockerWizard.exeC:\Users\Admin\AppData\Local\e0bbIfNJI\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\Aoa\tabcal.exeC:\Users\Admin\AppData\Local\Aoa\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\wjSI8UxS\mblctr.exeC:\Users\Admin\AppData\Local\wjSI8UxS\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a278386034909e40696de209b501ad5b
SHA1d256913c61be2fab904df019743bf8583d9400a0
SHA25678b9264eab781cc168283d0be6f8565e7b26948013b8a80573e51d3108da9ee1
SHA512de9ca2d0b9c829e880886822111c17184252208b58cfbc1f740e932184d0b49334ba5fda080d8cc581edb53e900e97594912b63a75d65c01f2efbb5a94a443f9
-
Filesize
77KB
MD598e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
Filesize
1.2MB
MD504f376a457edcd4613dd583f1c9fd682
SHA1c8c24774d5fa7afdd3ac137649cb39fa8043cc26
SHA256645bda6c20afe326bcd6d296716cef4231278fcd3c98499c7a993acde438fc5f
SHA512fdb988e60f85557b4d8b02a8644613e3497cf843caea040cfa23bf267ad0ffbd8c318a8d5d4a2436666da92d941d149ba71dfc4ee1be8968d089f282c6a8fca3
-
Filesize
1.2MB
MD505efe31080b58c879f08a6033dd9c0b0
SHA1074bd2bfa07bd241568dade3a47574b978c891e7
SHA25679e6048676eab60bd9eaeb2fb0c83ad80f80c2a77ecca91d27d1474d5b6eff5d
SHA512b3a8d8dc6959a056285686f6c663bd2ce896ff6e3aa18411a8ead52e6a4a50c025989b77e2496257349cb9ddd65c05db25c5252a5d3651d8161d52bfaf1747e8
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
988B
MD5bc9e3f9158a4da81c13bfd2bdff03973
SHA13c3564d971599ac5d73737d15fc0b870c622660d
SHA256ab321459a2694db1029d7e2bd402a411a4933e1762aa735ee93917794299e232
SHA5128c9d7ab2caa922455187a6cd935ce71f7f28cf8744f53c3d3e6008df8d16aa69ba8ffe72435bb91d038c57e334b716b0a89ce7d33e36bb9dce5168f300b0fbee
-
Filesize
98KB
MD508a761595ad21d152db2417d6fdb239a
SHA1d84c1bc2e8c9afce9fb79916df9bca169f93a936
SHA256ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620
SHA5128b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB