Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
14-08-2024 14:30
General
-
Target
967a503506ff447b27fe29ef9b72c2c1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
967a503506ff447b27fe29ef9b72c2c1
-
SHA1
b6378a7ad579db6ba868da3c051f6d38b7077094
-
SHA256
93524ff07e2650a8134290cd0c894af2b4855d4654788141ee640f34109f1ea2
-
SHA512
d7fbf7538148c5f22c51b82e9c98da414e322fb915f2fb3d103466abe7c35a4753b39eec181ceec22e381f091aaeed3c64007721e0e85119410c6c1b87093b1a
-
SSDEEP
24576:quYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:y9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\967a503506ff447b27fe29ef9b72c2c1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\gCLyXoJQF\wextract.exeC:\Users\Admin\AppData\Local\gCLyXoJQF\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\hExwprja\sigverif.exeC:\Users\Admin\AppData\Local\hExwprja\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\K1KMI\irftp.exeC:\Users\Admin\AppData\Local\K1KMI\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD559aa1248d2eeea83f182a363486f80f3
SHA1c98c85fd9721d3897b2e20921606c63aeee416f1
SHA256571fd4b7ecc3e63344e6a2c964a554b8487f48a35f283c3494c8ab8202f5fd19
SHA5120dae8e5676763de41c2aa313daaf2091125012cf7a559da68940fee3784c614fd82b2aea3d72e4b2a7b601184b5718cbe75b0c9a70e4bfa45476e5a7a2b65ea0
-
Filesize
1.2MB
MD592359e5db622a6ec3895d93146276cf7
SHA1e45b165c9c4bcab31f9873015dba146033f04914
SHA256bab61d17b906089fc1a896c8b3388ee0bba00191813de997fac5c198c87530ed
SHA512621fb89b608c150234b7750fc55fb16b19e1b65ca764a47afbd37a885cbbde4ba0f67b4d2705d6804b06268d09dfd64361427f168c6e093ad1a8a7f9227ab7ce
-
Filesize
1.2MB
MD56ad24a189aa862a484484d7ec1f0a807
SHA1e67f3d6f07f024b966cf8037fd75771d87dfa980
SHA2568963a1e751d6e7c3f840354efecb369618fc64cf852db713d966d4a4b48c3057
SHA51275d66b4fa11aed45924fa14d2bb4199e6b851b41d36501e53b07fbb8596e1a9ae1ded3e621456b2464d33052a042e3a63bb8e3e3179a65425d25297d6cb5bae6
-
Filesize
1KB
MD51a9ea09a06da7c73002eaf6a045a5e39
SHA10d92e56ed7fc52c7e41db098cf52b94e3587132e
SHA256a16cb297fd9859c9ef3bd573beb0bd048175afbfc0b1c1dc998d1d9de4f258de
SHA5120393f79857d5637db849b28ec09c668986e0c27cd0013490c9bbea000912bf75f030434aa0df52886b7a10c2a95f24f48aedcb162116c996f3b415d72a987c2a
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
73KB
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB