Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
30-07-2024 18:39
General
-
Target
799a60a13199faa45a6c016aa9721706_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
799a60a13199faa45a6c016aa9721706
-
SHA1
c572d26d09ad7f652f1327e3a3c2caa8358ee55b
-
SHA256
7c708981d426ade7e53c8627a4ae6994591f2ea2787291535cf782aefbd588cc
-
SHA512
c8a70ac097d28c18cfb1b0176d8c45323cd0752f7d9076196bf62b123fbff62896aba4052d687dab27e4aaf8d4fe7d9487b05bbf308e385adfab2533186c3356
-
SSDEEP
24576:iuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:q9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\799a60a13199faa45a6c016aa9721706_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\Nb0K\TpmInit.exeC:\Users\Admin\AppData\Local\Nb0K\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\StikyNot.exeC:\Windows\system32\StikyNot.exe1⤵
-
C:\Users\Admin\AppData\Local\vxQy\StikyNot.exeC:\Users\Admin\AppData\Local\vxQy\StikyNot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\aJp6wN\rstrui.exeC:\Users\Admin\AppData\Local\aJp6wN\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD536910fa55d65e141a982dfc50404ba21
SHA11b608dfee769762c30cd862bce60f2602612d311
SHA256582a10161c91b9fc3a830bff17b607795eb75f1cd9f3232b45c54304c519a5f9
SHA5120839587fd945be00e447da9fdd2e14c446146fc74589876701fd067e9ef4f7d7776f32b98ce95fc3972ee0403e426c06458bc427e1fb12aa8f1a6bf187cac275
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
1.2MB
MD5e3c0a4b74f5bc32ca5985d3ea3a8c230
SHA16dd4b1e85fbb7a957667949d0cb0eab18880b889
SHA256e0b2ce03e836fa14afc45a9cef5e63fad13057e0e1ba25d578d619ae33c1e3f2
SHA512809ac646b29f16bb1551e6f6321dac2eec2e2343e6dfc022d141ecf3b3b4f5197895ba481320b4cd5fcabb1c008a03aba1009a2774c82dace1264baf07518827
-
Filesize
1024B
MD53ccdf593b99cce99d3d85c8218dcbfdd
SHA16aa550078ccd70861ccff506e2140bdb3ca88475
SHA2568d8994628579aeba22b86136442ab195d7ae29bbe6df4946aef4a69efc0e55de
SHA512c9a513b7830722f735e06aedda8c5d16c3b27c7f836028a0596a8c71b70ce98413226628075a1ef76adba42ff2b4291cf45848466e9808a526040a1c0f6155d7
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
1.2MB
MD53e9bda70dcb0047cd24f90505e4fc719
SHA119463bc70018ea5cb8bcd1251b56a384a3381178
SHA256f8c6c7686a791fb2e1e8eb0b092647654345f8b09ec90c10afbe66200199ccf3
SHA512f436ecca83fa27cf32db2eb7a77566043cf37b539b853231c100115b1f54af6f5b630070c15b8407b5cb55865d289d85b8d715d6f2af512ca97b7d5225a402bf
-
Filesize
417KB
MD5b22cb67919ebad88b0e8bb9cda446010
SHA1423a794d26d96d9f812d76d75fa89bffdc07d468
SHA2562f744feac48ede7d6b6d2727f7ddfa80b26d9e3b0009741b00992b19ad85e128
SHA512f40aad2a381b766aae0a353fae3ab759d5c536b2d00d135527bba37b601d2f24323f079bd09600355d79404d574ac59201d415ef64c1568877ad0ce0da2dd1d5
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB