Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
29-08-2024 11:27
General
-
Target
c8baf35e81d9fdc69131c9ceba69f06a_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c8baf35e81d9fdc69131c9ceba69f06a
-
SHA1
ad1495128510e0a7eadda3d4ede0a06c3744a46f
-
SHA256
21bd6ef058050b15306f88b3ce55c92df07610ac8025a9975c8aaa3a47a53ebf
-
SHA512
b46cad51d6d6a86609bd120b4b9effe3f715bdc7526682c846bf6301e9c2cfb041b8920301201398059c0385a1152669c7c7d6704599203e24b225ed5d970b9e
-
SSDEEP
24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nat:X9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8baf35e81d9fdc69131c9ceba69f06a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\icardagt.exeC:\Windows\system32\icardagt.exe1⤵
-
C:\Users\Admin\AppData\Local\hQoR74f\icardagt.exeC:\Users\Admin\AppData\Local\hQoR74f\icardagt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\r1gVSsH\unregmp2.exeC:\Users\Admin\AppData\Local\r1gVSsH\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\f3RwsDBhX\rrinstaller.exeC:\Users\Admin\AppData\Local\f3RwsDBhX\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5393b34ea39ece1d8b18a8bcc0f617619
SHA109a92e58144d6244ad5d6a94beb9dcf62618fa4f
SHA25668e016287bcb6898f2a1f3865328a89089a7bef0566fd4153a7d2647f9a42ecf
SHA512bf1e4738c9b21637976526ea5f444513a21bfb600f4371b29dab11f194c6e1f6928c5821ba04ccea3514b7b527ecafe040841e84968b6996f21248ed2dd4ee72
-
Filesize
1.2MB
MD554bcbe95baad03dfe60010dbed54250c
SHA1bc6564659c3b7fb67fd1130e7253ceaff185b049
SHA2561c95e6cc733f6f4a6242a71df596a1933f53d3a1561f7f4ab0fb733987d1ee14
SHA512f6a02b093a2aa07f88863a7db9da29c08eed6778d5ae644e041ebd20855e3496fbc1dea91f5905241d9e306d8d7aaedbf676646583cc7abf15efbbd2b63f5863
-
Filesize
1.3MB
MD52fe97a3052e847190a9775431292a3a3
SHA143edc451ac97365600391fa4af15476a30423ff6
SHA256473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
SHA51293ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
-
Filesize
1.2MB
MD5644dc38f7a6b3a553785c874d2b5d925
SHA178416e70b0069cc0b5476075c0b5d00c10a7ad03
SHA2565731addd4b0a8d5b4327e3a353cc985727abc5c3001206d1a54c07bf009de9c0
SHA512d3633f54ae235db55118e24c5df5c57308e6441d2aea969c2e951bfa40d4c3cbf8f1d8422f8d5ad84b88c2ffa4c0b256e72f40be0d44bd24cd9652389041d7a8
-
Filesize
1KB
MD5565b1d9fb955ad123fd2d29a0629c062
SHA1623b55a6d2f9bb979a62a79a8f662d78bc9086a7
SHA256c9bffe29e470c23395660ffedf1b9ca77a2634a6ddfe7142ed5798b82ff868e1
SHA512baf7381b2a080d3f00d3d6e0972ed972d0b86af033aade975fac3d93141dfcf1c56886fe424af6533775d308ed3ff5bbf04b8783002682aced6d922e4f85f87a
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB