Analysis
-
max time kernel
149s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
19-08-2024 03:24
General
-
Target
a9645d8d4bd77b185fe75c17173fd55c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
a9645d8d4bd77b185fe75c17173fd55c
-
SHA1
efe6d2a7684b2c66de1ef26484a2838d49629f02
-
SHA256
05f584345e0092fedeaf52c65be820f9ab66b3a53b8aa92d20d2ff5ad7ed499d
-
SHA512
d17e1e251720b509dfff40be060359d07589d811ff2a959c061c4fa929b7b5821c5e30488b63623dcf2cc626ffa638b31b5566a7e33bf9bea597a1b099ccd082
-
SSDEEP
24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9645d8d4bd77b185fe75c17173fd55c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\A4a\SoundRecorder.exeC:\Users\Admin\AppData\Local\A4a\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵
-
C:\Users\Admin\AppData\Local\JNy9Q\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\JNy9Q\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\KWBt412\winlogon.exeC:\Users\Admin\AppData\Local\KWBt412\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
1.2MB
MD553d9694f4ef7c411d8285bf337c7c870
SHA15459a55bc34d061b469da343ebf870599fee7b5e
SHA256d706da67d152784f98c470bfbf9296cdcd38759d21b300abac2378e6b591c78a
SHA5125d0ddd0be7222316843e244938317e5739a480a7dfcc60a98cb86ce7aa8fc8c26b29c396daf09ac9aa1f71213acb813f90b0ec25785c0a6bcd70764e40b0480f
-
Filesize
1.2MB
MD5d5e9624f029e46da7b1c79c1a63f53ba
SHA169ee4beb9f19cc13f0565d0eaa168bbb5a06abbe
SHA25672bf39c43ef8e3863da1977c5ebda3dce5d13b5e5f6338708e064b86db805cb9
SHA512b9f0791bf86aaaee0c66b915027295fd1354fd93b329f503790d5d1d079ecf898f6e7369b65c6cf365d07f9cab3418c2924ada39896cd24358f5e47fd4882130
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
696B
MD5b78608d9fd1a44629a68039b8c8c6689
SHA1a9b13cddff85c885b205906deaac05c23deaf597
SHA2566814b3f973472db43b2d43a1c61caf6b25d51a22e9a032c663ab6d039f831a81
SHA5121379c804dd2e67bfe19915fe4acb5d0b8c69868cdabde1b06284319124d72337acafcbaa2b6aa5399e0510975d9502330a8747b9ec50694b5671ff7027175616
-
Filesize
109KB
MD57e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
Filesize
1.2MB
MD58c29b4df6298a9816055f04e433a3d52
SHA1ace8652473022edebaf95b2f5b5fc376ebd7d358
SHA256fdb5e8abd48ee8d759191545cbf4c3a275586e6938732a0ef6cd3ea7fdf90a5d
SHA51251e89293bff0686ea747715739e37a1e3f9c36af08726f3a5f0a3a2eee8c396593b69bdf1382d0d92f37fcee672b24bfd59da28c754992fea144471c9ff8d3d9
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB