Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29-08-2024 12:05
General
-
Target
c8c93bdec2879a4b3c23f3a3c8758777_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
c8c93bdec2879a4b3c23f3a3c8758777
-
SHA1
df26f9d9073ad61740eedd00a48446100c929761
-
SHA256
d00def281b5d4e5f7279628c9c4bef32598d7d476f8a3c7bcd44a7eaf47b9ca1
-
SHA512
90daab81877824c9846686f0f9ee8e762e1485e6dd2d82db8a5a2414a73188857a3031ecf5b4f4ba82006dc08ffcf64d47f6de44421fb147ed727f63d12b3f2e
-
SSDEEP
24576:4uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:I9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8c93bdec2879a4b3c23f3a3c8758777_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\hTud\mblctr.exeC:\Users\Admin\AppData\Local\hTud\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\SQUN\ComputerDefaults.exeC:\Users\Admin\AppData\Local\SQUN\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\ywCCQ7r\msdtc.exeC:\Users\Admin\AppData\Local\ywCCQ7r\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
1.4MB
MD55275c24c367708d84c63c3cfac63f943
SHA1136d7a0552ba8c683075cde93090707629407a04
SHA25691d1952118a082de74927644601e1c9a73ea1c904fe60dc9ede71e3e6662c6db
SHA5126452d61c1d3a1df3bd80e620eabc2f5ee4dcb120d2bfbf8f6269cb6579e44b95fcf16e2561fbbdc2125b39eb99c0ea75910345caa5ae6da540d5074309f7425f
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
Filesize
981B
MD5e8d9995da564c54c6238fb3a0b733702
SHA1e6aff96e428dfc3ce6f04f81ddb0a8614e0edaac
SHA2563c476ed9cd09fc4c61b8947b19f23cb8ea07ca58296c39fc046fa5561f79ab60
SHA5124e8a8bca4891de7f3873f84fd2d7392fb207adc3f537c89da6d727bbe45b077a1ad3256844e9b6c8743565b56ae2c671a4aa415d56b81b4fa378c4e7feef7373
-
Filesize
1.4MB
MD55affb1b7681820ede66ffe27616d8f23
SHA1726e47861090d50b2c3f38ab46a93e107c47815e
SHA2560ae9d53de5fc1c283b0619520b08bc468640a2549146ae33d638d74d45dc816e
SHA5125e647b0254f1ac4d1672ddeb8f8709cf3341ac4cbe1e97f7152ab17b1b29bfd9c474d07bc4791b8271654d73c3c09955c23436751b7bf7022bd3e64504096604
-
Filesize
1.4MB
MD5b07f4ed836eb25b17298400a01a3f706
SHA17781f2d671b988840a82e373da58679bb712904f
SHA2562c73d5839ca612f5369138dcc1f7864f28576014d92421d43a0f358ae8f0c206
SHA512f19cbedb85c1967f1605a7ecef5b7a4ab8467c37718379e6692de082135108d02a0590f991b1715d26db801e7aed2fcf59747edf19f245aca9b503787323ba3f
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB