Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
14-08-2024 23:56
General
-
Target
982fabb733c2a30259122452b2464dd0_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
982fabb733c2a30259122452b2464dd0
-
SHA1
4b02a19b6354b3274f756d19a1496c1483a27ff1
-
SHA256
4dcf29b7d5c46b1647550492fea89934c0279562875c1c1f5d2a32eadddfef2f
-
SHA512
5f48b719565cb370e264d9443e0971f9e275b174caa06002d85f1cd596d3665113fb51b63bc99688d50072d8d4c0adb4eadb182e541dfd374562348e9091974e
-
SSDEEP
24576:fuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:h9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\982fabb733c2a30259122452b2464dd0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\08nLMZ\notepad.exeC:\Users\Admin\AppData\Local\08nLMZ\notepad.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\mwne6sJx\p2phost.exeC:\Users\Admin\AppData\Local\mwne6sJx\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\oNzFDMp\spreview.exeC:\Users\Admin\AppData\Local\oNzFDMp\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a40e7789c5111201e21bf0f40a9324c3
SHA13e25a747581ee75ebc64fde4bfccfd111b898170
SHA256532ed03a17ba5fb8f49db41d60ae882aa6753c2af61349ca67a36f56b7aa6394
SHA512d89373588c12c855a81b989618d315595745d1b86a237485d7fd26e41a0d5da5d9ae0d0232b5e6b5ad3df70520fa910bf82c635408a6ef182b263c96bafccc16
-
Filesize
1.2MB
MD521ade15624d6bd313f24f80abda17c13
SHA1aecbdb4aebf980ab0390bf02a5f02f1819b39d9d
SHA256bf0acee10e30cc8f6391149d19994b15e7ec3f2a4411512fd92d8b39409c49b8
SHA512eed09fa9ecd3b199320b44f6a4b7f523fed32323a5325f709068c726caf40eee5e7ff25262bc2be1ad14e0413f72df736edfeedad82d6486afb621f683454dde
-
Filesize
1.2MB
MD50c5278cdcf8e70308d979cbaff4ea28a
SHA1daf22255413e317948d0c87e1da9ac41e6d9d646
SHA25692b97ba370fb15acff93902aa176de6014d8e2d9113d913dd02a33a8e5953ea7
SHA512316f9a89b3a20568060922c63ea432bf5264a793b953ee9b89bb5d089d755b4e176fee9edd51b6f7f7ca3a2e3ea3e6e9ccdbf4b5cf86a99c3a4ef8990d54f04b
-
Filesize
1KB
MD577864fb128983cc19be66e73cfb4c13a
SHA1c3ba8ac537bcbb70a667b07d20c04ba3be292daa
SHA25624a1af1fbb4bc433940926b3b711eaed2ff381a540dbf4e0a0e244f466a96c38
SHA512409f8c29b1dbc6cb48745c7c434de8ef8a95bbc95b4c47af52e122f99cc79890cf40b849e21bbfa4e22834f52bd63f21e3f681d3edeca1dbf6cbd6ea95a58dc7
-
Filesize
189KB
MD5f2c7bb8acc97f92e987a2d4087d021b1
SHA17eb0139d2175739b3ccb0d1110067820be6abd29
SHA256142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2
SHA5122f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB