Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-08-2024 11:56
General
-
Target
a26e9ff518e0a7dcb126011e6236057a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a26e9ff518e0a7dcb126011e6236057a
-
SHA1
e091c8effd602b07c71fc1a3aa7bf3ea81302b0f
-
SHA256
fd8a212a919eac3265b57d306f28a39c130b445c81776bec3488c009dad0b51f
-
SHA512
9ad562df0826fb24e9aecf56a22bda8b666c7820e177e686ab2a7ef32b4d6081f1de7dc855fec328d026bf7bb6fee458b8cb46203481604e9b1d996daa0971b5
-
SSDEEP
24576:OuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:u9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a26e9ff518e0a7dcb126011e6236057a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\p9iD8qB\PresentationSettings.exeC:\Users\Admin\AppData\Local\p9iD8qB\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wisptis.exeC:\Windows\system32\wisptis.exe1⤵
-
C:\Users\Admin\AppData\Local\DiKW8\wisptis.exeC:\Users\Admin\AppData\Local\DiKW8\wisptis.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\liY\TpmInit.exeC:\Users\Admin\AppData\Local\liY\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f4f411195d90336dc8f47d764dc7aa68
SHA1a770a8defd842bbd6940b7ba817331e2a3cfabed
SHA25621e4da6fb8ae8126e66d7ffe6617ab926def0132dff7c66a077a025f50ff82e2
SHA5121f882f776e0ef41ebc097ed33fd754e35a415a1bc6005ecd85bb918cdabd25ccce9bf16ec4cb9da6b49ee006057f55a0b6991bee7e64452c8d42240166657fd3
-
Filesize
1.2MB
MD5825247faee6890afe591f0555347737a
SHA154bfa28357026dca80df2940a7fc2ffb7deca627
SHA256a87936662c5997c20226a73fed2ee4af04a6efc5733f7a76b7cf452d4dd0ca92
SHA512c5ef3baa33cae866d640e271c912e3fbf60c1390457e4a41976a3eb4fb1b13223c926997a157b228f6f6ba7c40fc699e419e672267ce3756f1dfb97c7803970a
-
Filesize
172KB
MD5a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
Filesize
1.2MB
MD5e39656deafd00ffeb5b2322835fc04d6
SHA1024d7bd1d857ae900abd887aeaa1da2155329aa6
SHA25603f60b8852a203d4580077a9b8d07b172d3dfa6e5369c95564d33cd734d4c44c
SHA512009839806bc5e73e480d7d20db79fa3ad9da4909fe4776d94ef032e99bfe2857472f0a53efe9ae78a14f3f2cc0718fc01cf0a1087de98dba1be15063a8d1883d
-
Filesize
921B
MD529c491d3cecc4e81dbbfe91a6a38f3c3
SHA12d86c159ffe827a6e244843dcb7a9830e834a4a3
SHA2568faae12dcaa64bb5035e8383c4d79b29c8cb8d68828fe34309459a5f77efc5c8
SHA512bb25d0f1c3d9f9a1b89839cbdab54ae015e2b7153f5520dc1722984181ada4a116899248c3708c0a74431f764aa31e78c40ba29a20613f8a5fa237242d9a9da6
-
Filesize
396KB
MD502e20372d9d6d28e37ba9704edc90b67
SHA1d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA2563338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB