Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
20-08-2024 20:24
General
-
Target
b0b3677fee7f89faf693ca213d5a015d_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b0b3677fee7f89faf693ca213d5a015d
-
SHA1
ef0d03cc3e7ca79436e44f139ccee4e5d065a1ed
-
SHA256
e830844dc22da54e71775c667850099c419ea975fd46ae52ac0773851674d20e
-
SHA512
351cc8237892250cf03be76334365d619aeb23c2876afcd16f47d7b5004c4ea3359dda729cd9fe0e7234734c70896cd1dd77a0cad54d7734254f718a1473638e
-
SSDEEP
24576:vuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:R9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0b3677fee7f89faf693ca213d5a015d_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\nQyi1\rstrui.exeC:\Users\Admin\AppData\Local\nQyi1\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\dib1\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\dib1\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\srjVA\spinstall.exeC:\Users\Admin\AppData\Local\srjVA\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD531910c8e43599867cd9994cf212038cc
SHA1fd1a070929bd9cab47c6e703be65262dd67124f4
SHA256e8e7306c045adff36e07a78520c7b6453d7c4a94ae3ef26360ead8b03de04613
SHA5122dfcfdeab99e0a70362508359822e30fa6e819c6629b90c41a9e0092e161c251dd002b3c7ea326c3bbbc7e31b8aa740056d5d5ebb2915b3be917675dddfd84d6
-
Filesize
1.2MB
MD50e679b48d2faabf0dfce027baac6a148
SHA1798c16386af1d738591fb9616249d25a52f223d4
SHA256ddfa8d2673f17a49fcf24da5b5a7b9d63bd373274c0deb178109699423a3f734
SHA51282ab2cb60ebdc3398f171451869ba351be07f82b2d8eae9d1455a57b10cff578b595c4019c69923652cd79873f6db15fe0ed7d2ff5e8d62cd2d64773fb443c8e
-
Filesize
1KB
MD5f36893381131cd876a7071a1f3386170
SHA1f995eace4f3ac81db48218fc94100c79d00d615c
SHA2561787655cdf692cec1897529e1af00ef1f0d095ec66a94d500e88b46dda389f4e
SHA5121c847694f741d91ce43175bc64f3182484dfd2d0dcf136a1c2503e1bc7cbca54033a57f576217a1889649f808d596cc603a2722416f492234bf33510578b6961
-
Filesize
98KB
MD573f13d791e36d3486743244f16875239
SHA1ed5ec55dbc6b3bda505f0a4c699c257c90c02020
SHA2562483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8
SHA512911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af
-
Filesize
1.2MB
MD588b6afcc9457fa85ea26606df2a69857
SHA140dbcdb4da45837b81232b7848df8958b7b227ca
SHA256e2c025c7bcbc55293b0e5570c4f79aba2ce1320817fb732f6f1f3a3d019d008a
SHA512b5031f3f99a74af92a884aa6a1c3958d8bdbc9619a97046de45d5add055c339fab007a5b002d7d7e931b842bcf8a6501221ab14cac9d6745b07e2299dbf138c3
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB