Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
31-08-2024 10:41
General
-
Target
cca80d9e068acff700587abcb34c5234_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
cca80d9e068acff700587abcb34c5234
-
SHA1
d9bbd6dfafc80c3a0af3a6814abd237cebdd6c55
-
SHA256
480819cebdae01d450d58cd97b2a92b70f2ba4b01e92fa3c99add416e1cb4031
-
SHA512
a9e55710194bb7958b642231466b6ff67be5afcb0081ff6563813be380fbb672a198e70ba5d9b2eee4cc71ba5c5fb7320169d99d03eef574917c43e68d92e2a2
-
SSDEEP
24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nlpt:s9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cca80d9e068acff700587abcb34c5234_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\uTJZKvq0\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\uTJZKvq0\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\m7Wof8OPg\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\m7Wof8OPg\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\qHQA\Dxpserver.exeC:\Users\Admin\AppData\Local\qHQA\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD547cee5ccd66adccc2505bef6d8adbb94
SHA19f2281ad18a9936990dc631688c17bfb83f7d271
SHA2567f40b116d972b5e7012a5c2155e219f968343517c6e9f9e41b05786c5368f698
SHA512b1a6de0c1f53a9d61eba50d07da2c9f06f2a2beb04d65bc6b9aae4deda9c95df0daa4cce46673047c53fd14f66b27c900e3d74b4d641ee0c2848561373d59cc0
-
Filesize
1.2MB
MD54249fc4b899ffba484fee6f215cc902c
SHA1321e4bf6ad056e574587c5fc83a98906f45e6b95
SHA2567d568b723a7d1567cad1516f360416c1ac72465b61798162a3a197184930051a
SHA512ab08b6fd67bc91593b5ca7e96fddc42749fab4fff5198d8deecff843c907d312fbdad865d92476aff56a8cc9baca71e73389568ea3426cc585956d5d9c24fd52
-
Filesize
1.2MB
MD543217e272f474f27ad4c9e1d081bff38
SHA113578e768fca5b85b29864d4a080b01667e1f142
SHA25653abe9ecfb08068295fe420cc66c65073e182a34f3c07b0625188caea153b3a7
SHA512f4949b0efc1b665df69713191c8ee9d4e14653f0d12b6c911818eeea3b5221e9a6438f8a215f32c612684f9d7a6e479d23ca09f2061109573512dd643ab71124
-
Filesize
1KB
MD5dbef6b9a5d3fee7b0fe64de661ab3f80
SHA1b16e27ddecc7406b514c9ad860803f3dda9bfdfc
SHA256c900a1a02f1a0cec95eecc4a7994a4e8f7f3e90a6d159d680d5a4f59022797cb
SHA5123a6e93cef061c5f7034784604bab718238ba90e121b915f79b4cde41a08f3f72ee6b8251ee64540d131f2ba5b557d01f93da4a88b4d485e7968a00f2b64c0cd7
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB