Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
20-08-2024 17:16
General
-
Target
b01fcdb7f976ea702d6ed85384860517_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b01fcdb7f976ea702d6ed85384860517
-
SHA1
a98626defa6c2fcdc1f8c94989630b178e4525b5
-
SHA256
acc1afe396b1cea595c410a56c82f0049395618df8725ff337259994b0d5b486
-
SHA512
4629219101f8d1b5905a8bc282db82afbb7110a1d5102e4f860f73fdd9588fdec3afb47c954194428a77ae05add3fc8a829c8064b1fcb2d286eb82fa525fedd9
-
SSDEEP
24576:KuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:S9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 9 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b01fcdb7f976ea702d6ed85384860517_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\igKBBr\mmc.exeC:\Users\Admin\AppData\Local\igKBBr\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\N26o5hv5\slui.exeC:\Users\Admin\AppData\Local\N26o5hv5\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\HGGm\rdpclip.exeC:\Users\Admin\AppData\Local\HGGm\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\53qYX\mfpmp.exeC:\Users\Admin\AppData\Local\53qYX\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5268e8a858b182971dc4157c617065c7a
SHA18df13bca7516061af5329c9beba8135abb516c40
SHA256d539e71e2b89a208e344788d08654a6ede8c3616b6c481d8d5f044f893610b2d
SHA512f9ef8c0be84736eb8847816ae7d2d77d66f884ac24a9330e291032d25b26c4abf1f78127f0384f21b2636dec9a30fdf105916995f0994c1d24178b2254a3e432
-
Filesize
24KB
MD52d8600b94de72a9d771cbb56b9f9c331
SHA1a0e2ac409159546183aa45875497844c4adb5aac
SHA2567d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185
SHA5123aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc
-
Filesize
1.2MB
MD598c845d6c743c6dfdb89bb34ce8f2f0c
SHA17e026613848410e183afe709f3d115a70c9b092f
SHA2560c228c4a17de354ead38e2596c5a6e0461e56030098f96a0e65622b73fa56627
SHA51257ed1093b8ef3bb661752347b65d29653e3d9923731f8184d6b0335a1062ccfdc2219ed2c6f65e5f75ec84e684b7be2bfb2932a24fdc798d7c00ea7dbba9f49d
-
Filesize
1.2MB
MD5e61ccc3bd35b46b0c173fc59136e66f9
SHA1fda849d8bd8d7e481186bbaaa54caed91ab7866e
SHA2566d20512bb6c2cfa539773816d114b3b10966f4483c0e82e563049bc531370913
SHA51299f23c6c67c163f464734455be1c74b8d35a7da16f1b00fef6a607e1d1cb20fc78ae678d39c79d026e894628bc984da09f628c94e66f8b57821c65ad46e94f76
-
Filesize
1KB
MD5fe5ec622b1f2cfdc9706700fc70a9a0e
SHA1909c638967db8540bfca878bec9ffa74e5660139
SHA256bebd1e7a80a69abcedb98a078f967bf4c7d5e6bb2d940e8e516b2c6344219911
SHA5123b02ae30de2aa5157673ebe580c63c338dfbe2d84f9ecf8fd94e43eb219dd56f25ccc5b82cc2d4f072342432a736489004de90d0d9b779230cfce95137f171b3
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
341KB
MD5c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
Filesize
1.2MB
MD5140fcd0495a993b4d998b8f13d9bfa0a
SHA1e256c3b3910e7ad97a601c49c9cc8d56811f3cc5
SHA256ffdfec54f74a7be8516800305e505ba2eb19079fb0c2043cb78a396dd65d2ee0
SHA512338c58a0efc4b92f0ddd3815c73059d20eb57cbdcf3c2d993156691c211a40f200bb0e2aa6fecfc9e54d18f4c17d03f29c81ed41e79e1ca1c97466fd105e9b27
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB