Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
16-08-2024 14:41
General
-
Target
9ec755bc82d0950c88b7eb47e9f25f1f_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
9ec755bc82d0950c88b7eb47e9f25f1f
-
SHA1
5a72e981a2182ab70bb76365cbb5cef7da7b02fd
-
SHA256
18225e4c3113085ea7969d7eeac3507e25eb36eddb6aa4511ff2618473b82e9f
-
SHA512
3af88950dab298df873b54700467be8f0f3ac03efca508154cbbd5f6c9ce09cd5a5f24f240375478067be783f1e7c3ad38af568ed8f319b36a2bf89fd8fc9a46
-
SSDEEP
24576:QuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:A9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ec755bc82d0950c88b7eb47e9f25f1f_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\1wk1SC\rekeywiz.exeC:\Users\Admin\AppData\Local\1wk1SC\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\zt8Qd2\VaultSysUi.exeC:\Users\Admin\AppData\Local\zt8Qd2\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\StikyNot.exeC:\Windows\system32\StikyNot.exe1⤵
-
C:\Users\Admin\AppData\Local\yxvYm\StikyNot.exeC:\Users\Admin\AppData\Local\yxvYm\StikyNot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
1.2MB
MD5e2f51a314f2309ee091c880c29deccf1
SHA1ade81a141a45db05382c15b94da6fc653ca27504
SHA256e8dec1937edf5e436c9a7db68683b0953d075f8be286f7fa557196ba93db225d
SHA5122978ffb91a5e0d2514ca6cba6c7eea20a9166cc8923296ffdbc6f6a87e321c6bbb03398fb0585e511fba68faae670409b6ed836390ebcbfece049d409247bbcf
-
Filesize
417KB
MD5b22cb67919ebad88b0e8bb9cda446010
SHA1423a794d26d96d9f812d76d75fa89bffdc07d468
SHA2562f744feac48ede7d6b6d2727f7ddfa80b26d9e3b0009741b00992b19ad85e128
SHA512f40aad2a381b766aae0a353fae3ab759d5c536b2d00d135527bba37b601d2f24323f079bd09600355d79404d574ac59201d415ef64c1568877ad0ce0da2dd1d5
-
Filesize
1.2MB
MD56d7bb07fa69a945743c8c1c8c4823ad6
SHA140587c4807de75d08d6afa0212cf741d5bc91b3b
SHA2560e1de7e2d6fdc99f35466d6bfeabd667ad928251393c55ae7f8da74bed20658b
SHA5121d534348468dc10040b573fe17184ac833b4160416bda1b2af6d862241854a4d0d48aabf78ade66a0c73ecc4fd20a0d6d77be55888c648dbdc7476cd2f079812
-
Filesize
1KB
MD5b97714e67751d1a7246edeedad8c1d7c
SHA1763cf214f7581625b7d1bcc05906ffa71b3efc1d
SHA2568c951f81af5d4ca2e7ec74b24380bda67549849fd3322a2747ad7b760527d2cc
SHA512e821e1808be1c0ba5d98cac0bddd92dc9473ae2a296565c7acf019eddaa480443002fab1ba1ae5d9ea311b25ad3590d8e317fd1b4f6bd7d724f6d8935b1521c2
-
Filesize
1.2MB
MD5086736a93d751a5faed3cd7057bbad19
SHA1aacab84611172da0da85488e2940813c12171568
SHA2565df9c83acea55fa1cdaefb6c39d907b862ab47baeef57e92553675fd04fe8788
SHA5123208231cf1353fa4de473e7d65f28cfdfbee861c183e7e4a6fed01125ee30fa4b50974ea216c4dc3a2a99d54a9a135fd7098dff4cb1cefc9f1dd3615913f260f
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB