Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
16-08-2024 17:01
General
-
Target
9f37c38c61838641d596841f6a1232ff_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
9f37c38c61838641d596841f6a1232ff
-
SHA1
3334ad56daf32d68440ffcd6c838142c5822e650
-
SHA256
f0e9f3d5fced9258fdb6791c781c6844a172502786b058db47ce483493b1941d
-
SHA512
5fe41be56f5c65084cf13892da63eb9b33d6ef39a0214c14ea242d12aecdeeb85609cd2fc0638834bcbd4353ae087f1da443de756aeb00d586803f9629c0ab76
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Ns:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f37c38c61838641d596841f6a1232ff_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\Wud62\DWWIN.EXEC:\Users\Admin\AppData\Local\Wud62\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\DG6HCSy\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\DG6HCSy\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\jOKfg\spinstall.exeC:\Users\Admin\AppData\Local\jOKfg\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5be13c95e115857b1e4d3c3a75ce995ac
SHA16cb41c3c758b783331a15f7ecc998780e19fb325
SHA256515727a1b1ea1d67d87fdebe56560ff5da1ac8cadda4f464c64bbd0bcec72458
SHA512560474a0688fb3c7792e23d6eadb14a1876c85baeb36e6702d3c776c4fa8d9e85689af671509af0a0dc669c2de07c3f4fc93ac0239b10b5dd4b27ecdf73799a0
-
Filesize
1.4MB
MD506a87ad14a64cc4db3c29198e1704593
SHA1f406a7a49b591623d4dd64619f3cdcd8d30d3a82
SHA2563656b1f92ab44b5a1d3084c704aadcc5161ea0377a18f22ff0eda3c8843e52fb
SHA5122e779d20196406d090d402afc9adc1167356dab87563bc50bc0d91c8bc948a47582c4ad6830ec022afcd474c051e4df0ae2881522a7d100e6d8f8a4191630955
-
Filesize
1.4MB
MD52dc73b4bd92d65754d794e616af26d1e
SHA1f6bface46c83708328b5b6737c069b3906f9f0ba
SHA2568cde61901bff9cc3de19d4b38d344c8a7da58065bb68de80944e5cb16c82a42f
SHA512c5aab0713974c7a0cd76309107e8512fc5990c1210c2e020863a9410a7b82a5bd310ed04bf60f1b93c4c5c10d31fe20b6ac03ac153d60afe5ac9526ab64cf1b9
-
Filesize
1KB
MD585f01d4b24fa135259567cdb080fcaa2
SHA184282446b8030bcc0e6e6ec335845b21cd7562bb
SHA25666cd3efc0642582f706ea2ba6eeff66fed55c850d6915baf7be03c243df3820b
SHA512414a7918bd879cc015ee45de7ee14b25269e7c530447c37d98b4ce719f58e6a7af42a02c320953187519ba978c1a5ed70cd1a9f4f629e5d861cc7e317217d451
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB