Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-08-2024 00:53
General
-
Target
a4c489c2af8ca511afa7de96641d2f08_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a4c489c2af8ca511afa7de96641d2f08
-
SHA1
f8f54d4f16282bf6cfaa33216ba9d7fed9e2c9e5
-
SHA256
027e62076d92fb4a2ba14c63b2e628d47d5385d2a9f8af691bdb674cfaa29ca0
-
SHA512
eb031dac63ac09ecaf738e8e2968ea785ee9f3fa151442a9cd934ce4073a93538fbabea03575c46de42fd14e8b0870908f5c1d26ca97c125bc8ed5265de64b89
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4c489c2af8ca511afa7de96641d2f08_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\tSpW\dwm.exeC:\Users\Admin\AppData\Local\tSpW\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\nVHgt5JO\psr.exeC:\Users\Admin\AppData\Local\nVHgt5JO\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\Jzz0M\ComputerDefaults.exeC:\Users\Admin\AppData\Local\Jzz0M\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD50d0a524bcd256ca77ef7fa7dce57a81c
SHA1a420a44f4b9c4c1907f08fd15f4aa6fa59358843
SHA256a0510ec0f2cb933ba5618cd9225c3a87c104a2a57298929cf59dc630b5a8e4d0
SHA512760a57c7fd7dbe294abe6bb3066effe8eb0ee2316616088bdca3dc06a2f976c409c15c85f7b4920ae5f7b4882367f896f622b47f7da59409526ff5bce8fcedb9
-
Filesize
1.2MB
MD50ab10cc74b08b9b671dc3d81c2e895d5
SHA16ef95d0cb501a07f4b584f2b1e9367aa8ae96f38
SHA256c60c14daff73b3151738185c98e44f565c04d221b227ccf9b0be93e41972ba2e
SHA512406e17094b053611933fde04890388b821ab1e2835be6d43fbf150eac9f142a9d6957e0730a5e037373a8a81fac6b8a7ac17cf2a8ca1d9dd378054882c93dce8
-
Filesize
715KB
MD5a80527109d75cba125d940b007eea151
SHA1facf32a9ede6abfaa09368bfdfcfec8554107272
SHA25668910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495
SHA51277b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774
-
Filesize
1.2MB
MD5c415cf23929e0b9676082eafed8255ce
SHA1d74ccef9ccfe040cdcc6307d909b3dc957b24e72
SHA2568166ac48f2b8893bb90ff101d0f2ad3eb7905f850c72bb45a8bf284c8816cfcd
SHA512d008c9d16f9d17cdfcedee469ca74de4b3f25e1f77e7bb5727bc30950ddd7ac24670fcbf30a5acc65d63f76fbcc516e3c237a2402029054cb511cd9814235f42
-
Filesize
117KB
MD5f162d5f5e845b9dc352dd1bad8cef1bc
SHA135bc294b7e1f062ef5cb5fa1bd3fc942a3e37ae2
SHA2568a7b7528db30ab123b060d8e41954d95913c07bb40cdae32e97f9edb0baf79c7
SHA5127077e800453a4564a24af022636a2f6547bdae2c9c6f4ed080d0c98415ecc4fbf538109cbebd456e321b9b74a00613d647b63998e31925fbd841fc9d4613e851
-
Filesize
1KB
MD566d6e9b64fe01af3b7a28ba2077d7c78
SHA147b7994ddd56dcb102ba4cb3f2a3c6dc58445723
SHA2568879eab44ac186b5a2f20a7dc3293a48886d3f52f78e053936b96761bb3f942a
SHA512a771f29fbb462a14c76f0bc91d18375274e1741c2a2557b54bb25b4c1e0771327aae6ba479e6e45cb84f990ac60cfaaa1e6e80ab41353e63ab5e8a694fa79a5b
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB