Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26-08-2024 22:47
General
-
Target
c3f2ded942c2442b77fd47ce652bb792_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c3f2ded942c2442b77fd47ce652bb792
-
SHA1
b411d07b595927f4ff541b513faca778a85d38f3
-
SHA256
2483394b81137cb8a95584ee70556b2624b4ec757cea17624f2b17b8c975e3c6
-
SHA512
0926a6344d42a0f09262a7ce2e1b99f7009f8ab01b897dfde65a7e2df7e0ab192fd6f6d7b353303c10114e83d5d3d926cbd5c94e4f3ddf05b1a16231b3819977
-
SSDEEP
24576:iuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:q9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3f2ded942c2442b77fd47ce652bb792_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\MYDsju\rrinstaller.exeC:\Users\Admin\AppData\Local\MYDsju\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\GPt\notepad.exeC:\Users\Admin\AppData\Local\GPt\notepad.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\tfG\EhStorAuthn.exeC:\Users\Admin\AppData\Local\tfG\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5913de00551b4dcf062b59d383e1f35e1
SHA17c128d23db421c06dcc85cbff7e11e2a7bff1d43
SHA256fe6df807fd7feecf2fb983caf46866b41d35132748c42acb007b3e6cc8c2f826
SHA512689d0f1ee3cae3dc7ac74ef2861738e83969839f4b2b874e407c03109d6ac3a1c93354f997a541b319f83d559eb5847eaed91642dc82b1f5be6a020177e83a9b
-
Filesize
1.2MB
MD51fa74c90aea9b5ba77620ea9accfc6c7
SHA131f1dce0d551b20abe64a92aa9ee05d1fd995c92
SHA25635bf737b8057bfebf1ee61b749da429d1ee7e0c6df645f01d3a62fcb95796871
SHA51224e5017a608309be9b50637c476bd7e6b1c10039914e417eb2f8d4a5a8e6e7985010bc1b51903f8f02b50fba5bd0d12736ef5e795d48e77c8e504416b94170ae
-
Filesize
1.2MB
MD5a30198f3d2359d80a08abb9a19331793
SHA1e4e52a9b3c330b3cefd0c521352dac19408d93ec
SHA25679f30115f992264e7a5e365a45d39e4daa613baf3110e8eb128eaf7bd011844c
SHA51252cab32a0e8a4409f49b92b67b252972c48c85289fbec837ca8aaf0ce3cec25ed3a17e5e14a066a134537d1dcccdc1e77e118b7f664273b27e40511f94a3efa3
-
Filesize
1KB
MD59c6373d5bd0d36a0ed199e30d9a7b246
SHA1c8caba674691e3dff64300c648d21e37b0b4a78d
SHA256ab2d471e13ee7be52239eb133bc43d801be4f35b31a197cf55fba985af855090
SHA512dfc8ff68503c5b95705e3e73ff9b9640a2562982de9bc0afc02b67410bac8dc73b66b880713a84d750eb709d60184a3e0ba0038f2e4d4e117896a9ad0dda69d3
-
Filesize
189KB
MD5f2c7bb8acc97f92e987a2d4087d021b1
SHA17eb0139d2175739b3ccb0d1110067820be6abd29
SHA256142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2
SHA5122f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
137KB
MD53abe95d92c80dc79707d8e168d79a994
SHA164b10c17f602d3f21c84954541e7092bc55bb5ab
SHA2562159d9d5c9355521de859d1c40907fcdfef19f8cf68eda7485b89e9aa119e3ad
SHA51270fee5e87121229bba5c5e5aaa9f028ac0546dc9d38b7a00a81b882c8f8ce4abfdc364a598976b1463cca05e9400db715f8a4478ec61b03a693bbeee18c6ae5c
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB