Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
22-08-2024 05:23
General
-
Target
b67e1a99078ceeb5362a14bce73556dd_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
b67e1a99078ceeb5362a14bce73556dd
-
SHA1
ee4555a24557d837ffd2dc0fa43179df48458700
-
SHA256
e302306cb2efdb2aa9c986801e8e5b7f74a8ef7216020e69cb4048515109d09c
-
SHA512
a7bb236f33933955dd4f274f9828bd1026b8a8ca94ebc40efec8ffcf2e3c3223c48416c212602c8aade8ec8eeedacce1cac8425908799cc7d3b539c2bdcda6ce
-
SSDEEP
24576:uuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:O9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b67e1a99078ceeb5362a14bce73556dd_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\xeVPsQVbG\wusa.exeC:\Users\Admin\AppData\Local\xeVPsQVbG\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\G4GeducmA\TpmInit.exeC:\Users\Admin\AppData\Local\G4GeducmA\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\VKGwbm\msdtc.exeC:\Users\Admin\AppData\Local\VKGwbm\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e5fe0033a5ee62bd4ed946d79545f525
SHA1cb9a1f7dc5d583b1104e2201ad161aeceab4ea3d
SHA25678839d87af09b50640f4326e231312127ab30ed2fe45a7d13599771ebe802951
SHA5128789ece904bb7104e1e501268b8fb390dc43603e052a82f088190eb2d0f20b2441404040a6af618e6a9f878ee7d8745105a74d0228ff58f8555e4ab7dfd8cb32
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
1.2MB
MD51d6ca56bf62e11157b86bd5829ac87b8
SHA1de74c9d7e8d9748a6e4d4b93d73a00b829188283
SHA256536b16b27a41b1dded3fd0fbcdc7574790847a39960fe4cd16e5d70adf96535b
SHA512bb492dd3a1edf07ea32a9151992bbab050888bc9120bef18c43ef1893ca80f9946ce7e4416c62712a2f1094c0cf3a5ce0d8235b39b757fdcc3e9a2ba1d535b4c
-
Filesize
1.2MB
MD5be60d3a38332f96ad465d3f1b06ee516
SHA1bc2e47fb84105e6ada997ca829e40b72b12d53a5
SHA256d0b68e79fce1f0e7ebe11fffe79848a2a68e7f27d7df4d5f0c663aa80963a418
SHA5129f337914871c2900c5702435c57d54153a1a51b77240c1d3b47eabb30d6059f026eca6b12fd12628fbd700f0a1ed1995b83c0c944c3fc8999463b5cd86f382e0
-
Filesize
300KB
MD5c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
Filesize
1KB
MD55e1afb630417b93c3d1efe4546ecc7c4
SHA16080f80333d9d987f9cc2ec57061daca18bedadb
SHA2568a2d20654d56663fd6c0570e3c453019f35c41d7141db333f3dc5f2dbcbd1926
SHA5121f4669f15cf04286201444a3e9d3d18f26da1c2c6c646d308d7a770411e4c77b4408b5cc2c5aa3aa22e91cdb90898d0baf7c05a4c584384be40e519d91bf5bbc
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB