Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
15-08-2024 14:26
General
-
Target
9a653a6ca8bca2e4465c01ec60656a48_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9a653a6ca8bca2e4465c01ec60656a48
-
SHA1
224dbe5f344ec040c808667827eed50a30c7d8e7
-
SHA256
591c1e2c680af88e04a68e5401b6f40fc86835c6a3753068994822f8af071a06
-
SHA512
512fb0907bb2d248626ceb54371cd57230793748bcec48c4935c12ab47568f2eac4b63f6c702a602b2425b02fcc76584bd8a5980c5660ee47b81223071341b77
-
SSDEEP
24576:ruYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Ncpt:19cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a653a6ca8bca2e4465c01ec60656a48_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\H6m\OptionalFeatures.exeC:\Users\Admin\AppData\Local\H6m\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\BOxot\dpapimig.exeC:\Users\Admin\AppData\Local\BOxot\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dvdupgrd.exeC:\Windows\system32\dvdupgrd.exe1⤵
-
C:\Users\Admin\AppData\Local\0mClVvB\dvdupgrd.exeC:\Users\Admin\AppData\Local\0mClVvB\dvdupgrd.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5885790bd0dfa834d1f542efff27b7016
SHA1582ed11d8a359a19d93a1a34ddc242de7dbc8e33
SHA2569cc3021909f674d6b576b7465617b5df61544a88766b96ba3317633d304bd034
SHA5123f51da9a5f1eaeda10bf1d4ca6ac2e132967e417b3c53afd83e3fb7bfb45ee8420cdd625e9d900627515c72ec4a496644dd33729ab1935b4bdad6a74125cc7d7
-
Filesize
1.4MB
MD53ebaa9926f0e0a0df215442bae543696
SHA1fd4d2479c1f09b0ae8d52b028c0cfb93c793f2ed
SHA25689c8b18ea90049bbe421c48ff4bd27658a0f18d0720747a60fcbaf19e70ce40a
SHA51284836d5cfe031f7236335673706342efe55faf13c8511da7b854a6821684d9a942122d9138360565e5943938117a21cd228da9b9a2146b12b3acbb712e9afa1d
-
Filesize
1.2MB
MD5a85045faaa0f264a289a4e6021742640
SHA1ce4e67a58ee6ccaa1541047e22631a86374510b4
SHA25630d3d778972c10d9eb506d3fef6f2b45d4b279f727512da259e592206ed71dfc
SHA5127bf397579ffcb1db002da80cdd1eb8880f1d630ba2b8c19022ca7e4fbb7f39b26b31f587829069e48ff1c755088a049f50cac6332f51080341c874aa4cf892c3
-
Filesize
899B
MD5b477bfb2b3e4429b9ab996386c085117
SHA1d5cb4df1ec0b1c941e91256059bc70d560f2d51f
SHA256ad550dd3939082826e8a163579b5986a8da8029f90c7af49154416541e151365
SHA5127af36caa8e75dbad6c056d7c73b1c9c75c7506462286c38d5e5c73ddbf76e091ce1e432d8d8146a0ad529350688092c4f2406e720c1158ea5375fdf5a972bbd8
-
Filesize
25KB
MD575a9b4172eac01d9648c6d2133af952f
SHA163c7e1af762d2b584e9cc841e8b0100f2a482b81
SHA25618f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736
SHA5125a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769
-
Filesize
73KB
MD50e8b8abea4e23ddc9a70614f3f651303
SHA16d332ba4e7a78039f75b211845514ab35ab467b2
SHA25666fc6b68e54b8840a38b4de980cc22aed21009afc1494a9cc68e892329f076a1
SHA5124feded78f9b953472266693e0943030d00f82a5cc8559df60ae0479de281164155e19687afc67cba74d04bb9ad092f5c7732f2d2f9b06274ca2ae87dc2d4a6dc
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB