Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
13-08-2024 19:43
General
-
Target
9479aa71f97c0fbd162719ab490fda2e_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9479aa71f97c0fbd162719ab490fda2e
-
SHA1
4f043465c45e51d782522abee19fd9becd6b166f
-
SHA256
93a7f33ada113348eb0f47f7ceead4589b4878c7408e91f95691d5c5c68ceac6
-
SHA512
a52b69cf5e118c3ea7bfe4e6e818cd878616012153ca1d3979d449249ede3f12131f4cf9c862efc2f46c3f665672eb5d130b00336935c41dd657c813bd1b9c91
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9479aa71f97c0fbd162719ab490fda2e_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\NrIinj\dccw.exeC:\Users\Admin\AppData\Local\NrIinj\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\R5Rtwxs\rekeywiz.exeC:\Users\Admin\AppData\Local\R5Rtwxs\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\xObu0ZMx\OptionalFeatures.exeC:\Users\Admin\AppData\Local\xObu0ZMx\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
1.2MB
MD55c2a1cd5088559ade9ff05c998b89f30
SHA1aaae47af84b4fc289bf0d628f37981bfdd222880
SHA256beff68dd5158d90e434f7a661f8bfc8da4a6ee34167eea4b8aede69d6512d010
SHA5123f76f7791fd827724b323e6f779c03b7a53336ab65fcd77f9e3de830a131664e224e228412e1f2ebefc0cdedb74874426aced3deb9ead1c9f7c2c2040e3b7387
-
Filesize
1.2MB
MD52ae6a6725dca57b755252b51470ae07f
SHA1d8a6ef7548c64a0160f00aa35b3ac8213760096f
SHA256f84e65f6dd3c81aeee5620b97c75a02ac31f4e314f27f51ba47784fe794724a0
SHA51294ae6a8733dd78e4dc22a719a071417b23b585a02ad1c8fb7a45e0cb9c153c21930bd54be833136939cc31a2ae9797cc30308e3df4868d568507135ae1e8cbba
-
Filesize
1.2MB
MD51cf85e1b901dbe828cf0adaacd7431db
SHA18832067b5cda370a445edc12248f8c65acff5d0f
SHA256a1b49c78fdfbd3c6560ebcf17e3c4e683b580659ebe1d657095ed2eeef0cf99b
SHA512c9e5738f40268b09bc197943ad930744a52d5c15b593b2ebb73d1b2b1b461bb137e3b2db53ea665c1e1c5d3b1eb11c3eeeea04ef47d0f3291c002da653d1af91
-
Filesize
1KB
MD557cfc0e6d5918d7768c66f39557a8880
SHA122f3162e0eed79a387785e3826f39680fd20b99f
SHA256f196cb68da3076ce00ad641581b188489a9c6dd38ed61f8dfc12dbeeebc5b9cf
SHA512cfe2e590d7527981fd00aa744e50dc70cde63279b23c3ff4f45dfb05579b5871da30bf7ae1f982677cb223ddb92f0198509f5b8a1bc19cb1c4893b7ab49b9abf
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB