Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
21-08-2024 07:17
General
-
Target
b28fbffaca9e1074a6b02f7aa96f4ca4_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b28fbffaca9e1074a6b02f7aa96f4ca4
-
SHA1
832224f36aa0dc4386000d1783d46dbd1c99fe36
-
SHA256
fb0cfe24560a2dceaf2d198ffb4ebd793ee92fdedaaf63f54a32addd92728599
-
SHA512
c14b11357ac2d9657d0186a695a54072e55e598e8dd2f78b789001e8c5d7854a4fbf4cdddf3eb5a86daf8f42da6d7bfe16d4f29997c34c0d6023d0bfcc680bb0
-
SSDEEP
24576:xuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:j9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b28fbffaca9e1074a6b02f7aa96f4ca4_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\74Y2qN\xpsrchvw.exeC:\Users\Admin\AppData\Local\74Y2qN\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\wJD4H10n\ComputerDefaults.exeC:\Users\Admin\AppData\Local\wJD4H10n\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\xNXy\UI0Detect.exeC:\Users\Admin\AppData\Local\xNXy\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD590f9e2fcc30bfbc9f34dd16cb127c5e5
SHA1f7a7f6f39749987c5dc7fa7eb5fca4e9c538ed74
SHA2564414ad2b93522de89e2654f10684faf02204faf442c23ac12639dbbe7cb4cf04
SHA5121c9b8023ebe5c5b21236878ff77179d03a8307ba82a30c997943b63c33a806fe5bafe85c137a6128c3235ae596e8a3c1188651b7c7a9b991079237ebf8ac06ca
-
Filesize
1.2MB
MD5cce8643208ac76a65356fce2e31a281e
SHA1c33b4909fa074f17d3b7e71cc3bb4e4d50c5ea3a
SHA2567a6534b45cd4ab1ac0b0db81a90047951e26e104d1d851612ed0c197540c968d
SHA51246e883242bb25fec24ebe4c51fc28c222bb2b1522919788bc322064ab14cb7911d6ca354b5279098b749347a59f91f200cb9c12afa3951ef33c45c2aede06449
-
Filesize
1.2MB
MD56e7924a3cf6b6b71e6c79eac8e817055
SHA1a5c3a0cbc88cfd979a76021006a87b70bbcb885e
SHA256f2d5b2263ed4faec939af590bfafe0038a963aa0cec693f7bda2b17543a22417
SHA5128a8bb821fffacc5c7a347a93ca802f7e8129a06632c02b9208e536e42856de7c45f095f9675770bad7f38b05520c12adf0647d54b998a4cecc420a8004c00dbf
-
Filesize
1KB
MD5e76825578d4dfed1909d21034a9bd6c6
SHA19cddb0496d9a66e19d798e30629e92a872bda454
SHA256203227149001bb96f2df92bab38120d6d99b0daa9e48b4b1a3e3b7517a8d04d1
SHA5125a41daac9fb6470a471787c0a2d3a050e0c44efc0e429195b137973a4fb36cd53b06301e5f4a149c262aaef35cf2e69d3dbe8940e7fcc3bb72e20320b3902f04
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB