Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-08-2024 06:41
General
-
Target
b273fa97431153c131b5b9ae8d6f85b7_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b273fa97431153c131b5b9ae8d6f85b7
-
SHA1
6747bd7ef216cdf6d23e500c2ca8c41e851b109e
-
SHA256
f487a0f3b8ef34854390d1f67b57ead543c6a940a74bf00699264c183533cbe6
-
SHA512
6bc9e750e65ae49fa76d6fc1447b3386c79cf434871e75a5b6f2307ccd35b9105c8b6e5eafd610e618ce36ac4089cecd2c739ed05cb9bf9944327b40fcbc2e1c
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b273fa97431153c131b5b9ae8d6f85b7_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\BDkA57OWD\winlogon.exeC:\Users\Admin\AppData\Local\BDkA57OWD\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\PYzhQOGX\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\PYzhQOGX\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\vnSjTLwY\dwm.exeC:\Users\Admin\AppData\Local\vnSjTLwY\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b76c0444eb0a31f7bee49b245c2368b2
SHA111f0291b2a6cceb01839e20658b98f444ca30f9c
SHA25685fa2def56aed1c2d28371184d37584d634bb719f1037bf33a8c74e75dcdf0ab
SHA5128e0f0813d758e4f60e836d9b1e0eb90538c2cff3e82c3541575f6738497ab156d60185a83171168383a50275824bce8d2148f150e0d84c002ebc2db537a48508
-
Filesize
1.2MB
MD5f8b7d30692090a4e0c74e3ca55cc866a
SHA1f55f86ac060aca009c00452d74867877f4b2c127
SHA256b86cc5f410913c7307d84dd6706eab3d08e9226ec577cd2efc91c77b9062d24d
SHA512bb47969f69ee5f6650e5fd505d3e4135794137fb95508134420028a001e88de8359eea11d8c9c260af1ca359577df7b3d30636d1368645fe4d68d66cc0b29c87
-
Filesize
1.2MB
MD5df0b33396b6f9a24e428edf2aed20cb2
SHA15def2c48b17dc12c9a9ed6ef5cc01291101e0d59
SHA256620e493c30d003d8ca7438fd673a1329e1d17f651f2b2b9a27d253f9ecb972cc
SHA512bb8539753741c643771244ae41d1682a817d3fa40b0b1cd3fd88c24e04d2ebee9b392249248fbcfacab7b81d70763881fc27d73038d65267abef4a23d13b601c
-
Filesize
1KB
MD50dcf09478c08017f3d76a51274833a47
SHA1a66d27225fe445e88f06547041e98a72a34f434a
SHA256d37e038a287e1dbc8dca4df5d6eeb514f36b2f2d25d80e8f8e2272b1c3716027
SHA5127571dbd64103fc93603133639c1501b429cfbcb3672ff6c09486f1ecf407fbf77adda637dc387d499039e15ac965e73b15b8f4112b3d76baad5fe3f73ef8637c
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
117KB
MD5f162d5f5e845b9dc352dd1bad8cef1bc
SHA135bc294b7e1f062ef5cb5fa1bd3fc942a3e37ae2
SHA2568a7b7528db30ab123b060d8e41954d95913c07bb40cdae32e97f9edb0baf79c7
SHA5127077e800453a4564a24af022636a2f6547bdae2c9c6f4ed080d0c98415ecc4fbf538109cbebd456e321b9b74a00613d647b63998e31925fbd841fc9d4613e851
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB