Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-08-2024 16:24
General
-
Target
b42d93e77b5c62799de6e15c87e5aa0a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b42d93e77b5c62799de6e15c87e5aa0a
-
SHA1
00254ec7a4aea06c5836d06de5f395c03e8df426
-
SHA256
2fae4980756d9703b8adb56e7b874137e38a2a19d94874286517d7c753e0e3b3
-
SHA512
49dd41fbaf5f2107b041a8811a4ddd05d5e5ff6b52b4066c69b909cb2c7ccbb002057db58eeb2a0f34391cc7415963917b45b425510d3dfb2f0bd8350ecb21fe
-
SSDEEP
24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NF:s9cKrUqZWLAcUd
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 9 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b42d93e77b5c62799de6e15c87e5aa0a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\W7Ul\sdclt.exeC:\Users\Admin\AppData\Local\W7Ul\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\Kxu4Vejb\mmc.exeC:\Users\Admin\AppData\Local\Kxu4Vejb\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\VgZy9iLR\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\VgZy9iLR\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵
-
C:\Users\Admin\AppData\Local\Juwx\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\Juwx\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD501ddfdc267edb5ed9a00b769725fa290
SHA1541a417fa6a57a54da6e8798e98d669806e74a8f
SHA256d8fb86d3ecf2a78176d38820ac1d7afd53bef5cf12eb5278276feed69f7ad773
SHA512049f867c8c40f38363edc74cd5dbb0bf7c1eac995862e9d9116653abc82447bf96cd886e955c7ad12c83f1d8fb00b512d415fbcdea44bc3bb9abc2c2c43c6b3b
-
Filesize
1.2MB
MD59a59535c65bc9cde9fa43a011f709395
SHA104cfbe7994faa735a7948b13ca99cea027a0ee8e
SHA2566b32295f9341f9a8b0593221d7d4610444b4615b34be1637ae60b17f1f1acaba
SHA5124a993bfbe2c8c91a719d0c4b8710e08934f13487b9520d9b2d3b77e264f073c66da4e6e5e04dae0e9e1d75f9aad5f259b95c48e4cb2bf70b5c4d5e76600a57af
-
Filesize
1.2MB
MD5a307e000e5c861cd85638a6a4a5f3d2c
SHA19a064ffbd62339505724b216b39e8109713c5392
SHA25604c2a26916bda39b8692cf5bde38a0e8a3202ea7d3585ec053af7cefcc244394
SHA51211a198fcfd77953a503eb1ecd7dd0ed1dd9db9a72bed27b6829c30b1110d61b1d76cabbe8f4701f21b1fa3b9207cbce70e62a5702a6251151deba99178b4b599
-
Filesize
1.2MB
MD599c70a64a10a1ef5947b82058f39ac14
SHA19f10690cfbec62a886bcd207a991c8df9af767a4
SHA256976a6324ecdd36d1d3f3a5f1d596d2aaed616035a88f518eaf6d9105fb357191
SHA5121fcfc424cbd437bb051a8ce6a6d2541ebf7f18bf6b7a49bdaff756fba1356980843d0e9af56fbb32b13b705aecf7ac5191a49f731d247f2ea6c214baf0c1b80d
-
Filesize
1KB
MD52da575bb5f53baecfd4a4603e6a54cc0
SHA17ae1c496e8b1847ef2eacf4ad9460d1388b94bd3
SHA2568706a864f9105fb9bd3f3ad121cb07f52820feb09670208e31028745bb61989d
SHA5121355aed0019dc5f194ec842616451d94e9674fbfeb59ce4afe4d3bc007d3c8fed539284c4b83c0084c8cbbd20615e3f19889b51ae2adfdf6da437cf935acd99e
-
Filesize
109KB
MD57e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
73KB
MD59728725678f32e84575e0cd2d2c58e9b
SHA1dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c
SHA256d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544
SHA512a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB