Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
31-07-2024 06:13
General
-
Target
7b85a378b5aa0e00ad580ced76cf24c4_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7b85a378b5aa0e00ad580ced76cf24c4
-
SHA1
0252c8d455476716c277a75f0ff0846f0ffceba5
-
SHA256
01ff8188c74308b5694f1f5417b8dc8a2c5ac2fe59b4b10d792273dfd00c40d9
-
SHA512
79811bfd3cc4afa16bcfb48a2ced69b540b0bb710b6d4a8e0ae2e4e2f0c1349940248ca35ed485254c0e675e2925f1e7a5a2f190ac83cd00daa3ef5d64deb6b2
-
SSDEEP
24576:auYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:C9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7b85a378b5aa0e00ad580ced76cf24c4_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\NmGvm\SndVol.exeC:\Users\Admin\AppData\Local\NmGvm\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\R5SXG\OptionalFeatures.exeC:\Users\Admin\AppData\Local\R5SXG\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\javaws.exeC:\Windows\system32\javaws.exe1⤵
-
C:\Users\Admin\AppData\Local\zWN\javaws.exeC:\Users\Admin\AppData\Local\zWN\javaws.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD5c3489639ec8e181044f6c6bfd3d01ac9
SHA1e057c90b675a6da19596b0ac458c25d7440b7869
SHA256a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103
SHA51263b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9
-
Filesize
1.2MB
MD5447bdace59cf2ffd51e85841ff7e3513
SHA1bfd6197c394e5ae982f0fb2d3679e6530058ec11
SHA2565cf14f6844ab359fe3066401796a0bada857e6a52e1b52350ca998dad92aee8c
SHA5128449bfcb7e6d33a971bca9ecf534067784534f1549d142bbe71e1b3207758b0519a42aafdac9e924d713615017a103a8fad83b9ab33e4d80b046029f7723afb0
-
Filesize
1.2MB
MD5cdeaf6e1076766de28fc850d0c5353cb
SHA18fad1a33d293fb1a2ded6d05496dd5d86efbeeca
SHA256aa98484545aba8720a1c782f4a52fd09fb4dff32c35d02124784ea4ed6f15de3
SHA512a7ac4878560e49a999758283abd88abd25b46bb276c2a7c7eaf7d6986bf0a7a916d4f11fe8a35a043b01c9b8aecf36f28dcec33d2c304785963250db2b38479a
-
Filesize
1.2MB
MD57b61c775aadaa97ae68bbffa9ee81a55
SHA1a62e3b0bf0226a990f63a440f3992e0a3d2f88f7
SHA2564923722b9a567ee0caca2bb4fba5a3eb51847da7d97ee4af15fe3854f1075203
SHA512d399ea35a8d4b180f845be01c82de5c465c1eab9ed7ee2f280df3c22863d153597b434a700511ad35ba3ad7173e6551c41db50626cd0c857cd15cebf0ad38227
-
Filesize
1KB
MD5a803032422560dbc9d11479f1de2fcb4
SHA1b57d7c72c8a3d5285df56006f73960c1b8660411
SHA2566bb18e800862cd879259b690b301436f4c1e505b2a7ede1c2d73c0a9ca61182c
SHA51277a563baac8dcbc39c413f42a15b94e8597b947dd8377b5b13db706cde4ab3f87d33a2aeecbdee50935be2490d3dc68c2ed517316d9a54d56c85b587c57bb62f
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
312KB
MD5f94bc1a70c942621c4279236df284e04
SHA18f46d89c7db415a7f48ccd638963028f63df4e4f
SHA256be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c
SHA51260edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB