Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
30-08-2024 08:51
General
-
Target
ca85c8ac9e78fff1382072443b979d98_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ca85c8ac9e78fff1382072443b979d98
-
SHA1
ac2624a13f968db008cec1aac51691778b98c743
-
SHA256
f493377faeb311a801726886346632f0cecb8f6a70547a01b69114192c3caa2a
-
SHA512
3a273ec1b7b3c81a163bc2a5b4082da83427eaa798c449e34b25f79ca6ea4e84d749f319321604b9871ab4a9dc94b960d0e69a02244b9a44f7544a65bbc9b764
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca85c8ac9e78fff1382072443b979d98_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\pEEqqgv7\tcmsetup.exeC:\Users\Admin\AppData\Local\pEEqqgv7\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\CqQ\ComputerDefaults.exeC:\Users\Admin\AppData\Local\CqQ\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵
-
C:\Users\Admin\AppData\Local\dKL1H\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\dKL1H\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD59b591fe1d6f2b99594939a52989edf41
SHA1873420dbf94f332e00ee7f32cb6f251cff7c348d
SHA256fb11fb89f4853dd16787230e7e8e349b671a05b58953a6df2c425e71ed2f769a
SHA5122427e95452a729d5ffdb42d46406089f745df19fa1e3222f6a954a4ff37ab6fced4cef368b16c79b878d3f27681ca27076f2aa67a3824d5258273815e64fbfea
-
Filesize
1.2MB
MD51206c12994aed44a9417a4e1f955f281
SHA1a70f5d7fe517d3cfabe75d97a4bca4d170065a74
SHA256ebfabf3e25710e071f164623605fca93c47f7492b09e6275c9c75d67c673e15c
SHA512b8d8eaa538ada5f886b14019fd11ab67ecb492ad75fdaeef84c2459dd9f6fa3d2c6c86fe90cc2f7b0ce3758a3bbb4285b5a341e6ac68939ac4ecc09be2624794
-
Filesize
1.2MB
MD5c8a00f41c4df7701845e587671e8cf0c
SHA17397c5032d5b42dfe09862a03eabae41480a718c
SHA256d01b3c7cb899cc36cea601c3dc87ba91601b0b601c16b5f2f6b4e360603b82e4
SHA512d7e1e89b7aa728d920414b717f92b94af5d3b90931aa7226cc290839e620a7b7557a322018b1fe2bc3e4fd3199d9584df16af1e1650ba684964e38870b625b67
-
Filesize
1KB
MD539f71391fe10c0d6ef0b1f0f749b6103
SHA19e36099b4cad96ced1f57685f933b0a5991099d2
SHA256fb30de23e860846fceff321bf27d948a4ecab663edbea31e9be292fb6be7e7c7
SHA512e58a3bb815b0fb76001b60e3e3d5e030a872d4239af05cce217bf457425f3d13fa12e77b7c5bf2a4096d4398fbebf6982dc2aeb6ed140a25e7c218ec3f2efcdd
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
109KB
MD57e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
Filesize
15KB
MD50b08315da0da7f9f472fbab510bfe7b8
SHA133ba48fd980216becc532466a5ff8476bec0b31c
SHA256e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7
SHA512c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB