Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
31-07-2024 14:05
General
-
Target
7cb39a958205ae575a11bcfbecd2923b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7cb39a958205ae575a11bcfbecd2923b
-
SHA1
c098dbee02a9f5b0185a097d2907d05611c06d5d
-
SHA256
c239b07bc04c591ebb22d3ec9be5a81b73b5b36b80b867e49447284c180ad00d
-
SHA512
6897ce3683f63a898fb5859a8641833cc0bf230275f1cf5d8d1741b483ef660ab5ba7c323fecd9c8f28abcf5d606c4098a2e12dc9779c0016bae9eee43e06f34
-
SSDEEP
24576:5uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:r9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7cb39a958205ae575a11bcfbecd2923b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\OACT\dccw.exeC:\Users\Admin\AppData\Local\OACT\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\vI0iG\msra.exeC:\Users\Admin\AppData\Local\vI0iG\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\6LrK08N\dccw.exeC:\Users\Admin\AppData\Local\6LrK08N\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c591c329dec1c7dd84586f2691c8b08f
SHA1c88f4b0ae9380c291e6e3050422d3818fc5f720c
SHA256d508507066e1706a80ba95640a18afc536ed427ffc95fb3dd37c87a4566fe14e
SHA512c823f38b145c1844dfc0c765aa4da0a58d970dab1bf0a795ada27e54ddf59a943162caf385ac32d25b4a5a113de3988a1456f8fdfb34ef99ff12be5be5f9c4d0
-
Filesize
1.2MB
MD570e6927c4cf1aae23756a6bb0f0f050f
SHA138932a0982df881c37ce39f5db2e680e377835d3
SHA25654eccb537a68682dc2a51458ed555efff43a2f40b2c8a47da9caaef81527e17a
SHA512487ac9c533208dae4a6f7cab90dcb6d37e4678241d5f2316a3df4a7806d72aa3dee7f2d0b67dbbe3c1efa606cf610fe0b4a5eb1f2370c2016f3aa3b742e1417a
-
Filesize
1.2MB
MD59439bc3bd165ca329f089c796bd604db
SHA14b2eb467130e281a678dd00670899acc29d25262
SHA25670c4041788507ff4fb3ebfd63e804198d2266f836fe0c3fa6d717dcb04c9f18b
SHA512c90db3a5a0c6bb6e6e92f66a18ab6c07099fee6e6b37120d47961c7a85bdd58e888110b1200dd6d6c657fc109f00a474536d71d577040920ec1d4191d13d19f7
-
Filesize
1KB
MD5c99c222a6a561f2681613216d45c053b
SHA101303c2517218dab08c3b9481efd8c4d43d9bf75
SHA2569c497b5a0811299168d58f71cd07644ea49f7cc30b082200bd19709999039580
SHA512082da017faff7e590c13c91e91a4be099eef2aac3905c8cb686ec3058137d03651e8c65a1f6ca3ff9128816e3c285b7f730d7829c9e36d81a81107fa685ae39d
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB