Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
30-07-2024 20:53
General
-
Target
79fe22837f3351cc4c4734412120ec9c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
79fe22837f3351cc4c4734412120ec9c
-
SHA1
85bbcddc95e1a7bbb460f48b44990406d8ae7105
-
SHA256
c28471b6d5b4dfb26f7cc16f94d090fee743872676ecf36458a0f86ffd1d0a14
-
SHA512
cbf2ebf4248aa17ae04768c2b855a513ec07adac6c713ef9105a9ec0ef1b535258d08823e1e57ce4ebda7acca71e5ae23200e5b0a40779debffb9d796b1f45a8
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79fe22837f3351cc4c4734412120ec9c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\1ZFTS0\MpSigStub.exeC:\Users\Admin\AppData\Local\1ZFTS0\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\AoqK9j\TpmInit.exeC:\Users\Admin\AppData\Local\AoqK9j\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\TrB\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\TrB\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
1KB
MD5dfef339b5a0c3fb3237019b248b39beb
SHA13c1c10adf86ac14ff791f444f0a6100dcd61d3dd
SHA2561649e6df1774da5631f8d8a5b1170d76638e42d052c1b34ca7ff9d0856839c62
SHA51278d2be922c57a8305abf11784ba2e27eebdbe31aec2a418a81d293ff5fdf6a61e4ad99db2b6c27dae5e763c24ccc64a6e4871c3fab6338fab3e6a440581f43b7
-
Filesize
1.2MB
MD5f99a2af39a250ad55deeaaba8635e370
SHA16516ebbb0c6a264ddf12fffdcb1852be282fc62f
SHA256063b5908380b8029e751076c438a61f0be22580a627d14eb637a59d5bf2c1083
SHA5126967add0835f4a53c840428e087e4fc7d7e4db5ae6c4a185b36d8b8416ca681a641b0064b50de6104cd924ed3b6ed04b90edc04208c83f8f49d4d4afbc701e3c
-
Filesize
1.2MB
MD531e84df76b9060fb0524e8e7a1f5fda2
SHA1fde8274424207b83f2379893a219f59f2b19125b
SHA2562772499cb96965c72801ebedc9be644f188abaadafacb627323e1ff4eea823fc
SHA51257fc904397b33decee7b4e649ff7edc4a53a1594771a94bde058c115f86815a6ab17adfd2b910294ae8dd488b3ae054e79e9407d565ea361b31a6c7908f7c799
-
Filesize
1.2MB
MD537809498f11758ff6f6d9768818a9d2c
SHA1b45edb24f988ef8f3e3d272cd027af2bb64757a5
SHA256f870ab61b62da4f21419a4c44cfbf868fa461558300518d601089aea9e76938b
SHA5125dd0d21b793b040cfd0944d950b03d1ce48818ae89e39a0ae5f62f773c5ad64f3ceb1c22a24a8292c94289952dcf0701d578fe729c44330190898f5863eac593
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB