Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-08-2024 10:35
General
-
Target
a67261a15803bb7e21d3d22d97d8e923_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a67261a15803bb7e21d3d22d97d8e923
-
SHA1
f702e1a7cccc81d925e4b75796da0ace7aac8005
-
SHA256
b8c5142d09851bb8da18953b38041345f177a1ea49f2101da423f3d148a26631
-
SHA512
2f37783a9b247b9752b5bf25015fbbcd051fcc125bfc49ad8cc6d5df1da8457a0ea7aff6c3b14f2538d86e03c1534c032ec7378be20571ba5b1edfec4f0bc384
-
SSDEEP
24576:BuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:T9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a67261a15803bb7e21d3d22d97d8e923_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\fgxFON1\calc.exeC:\Users\Admin\AppData\Local\fgxFON1\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\792lk\eudcedit.exeC:\Users\Admin\AppData\Local\792lk\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\DYbp\mblctr.exeC:\Users\Admin\AppData\Local\DYbp\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD56162bd11a369e718465e82a453b63e48
SHA1e15e36d9e713461699c18b498668db1dd16cef0b
SHA2568274ef713e3802602e6115bf074c6c4395497bfdf3a173efae98a273e6d22b94
SHA5127266e0119c0c32ff352fb1f459f891d673f4ed866765f16ec7fdaa1d523e99a4632d063b7e9532f32c9d16b45414bdb4aebf11ce10154afb20e14f24b493a10e
-
Filesize
1.2MB
MD5a9836f80a765ad4dfb28ed98d0da3ff0
SHA1cdbf4dc3b747abd5369a95501c9a1aed70226c33
SHA25658f2cff00f728743e1504dfe4a12be8e8897008ecb79c6bc44154b44488d6fba
SHA512f1b52c896d9c3f3c6691264bebfd66eca2ac4872a24477b6ee56853d83d9012138eefd891aa2d9a73fa3e344516e77e101236c27a33d9f1e74ade2ad282e0d6e
-
Filesize
1.2MB
MD52a8aa05568cf91b474ee5ba018dfd260
SHA17a3eb2f518f00ceb34197e4db672f30315406930
SHA256a31f51fa9322758371f2b3bfa4e73f18e8754902248e5f818e0759203b61d537
SHA512eeac875b06c2434b631c062b42b77d5a5ebccc9fc5c09e6786f1808ba1b4abaed9ea18734b2a05e3ba02167e64dad27c288c19504b50ee042c1827466582993b
-
Filesize
1KB
MD588cd59a3b93b6dd800f500426cd8c87d
SHA13306fe143d5f0eb1adabdb5ea62393edf5541d77
SHA256263b45c38bc49b7c3c520c4b8ea4d9871ef5cb6133dfc37a24ce713693f12d94
SHA51280ee71b08823ff5075903162bd527c89ac7e3491fc9a94bae55aa4779c04601da186ff1a536033b1d94f296518f2a032a8d06c2ce0132eb953a3284b7764b221
-
Filesize
351KB
MD535e397d6ca8407b86d8a7972f0c90711
SHA16b39830003906ef82442522d22b80460c03f6082
SHA2561f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde
SHA51271b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB