Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
31-08-2024 13:05
General
-
Target
ccdaece63d6ac64a80d629b4600b457f_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ccdaece63d6ac64a80d629b4600b457f
-
SHA1
71ce86f3f7908eeecd91a4dca36d68fb8e64f130
-
SHA256
9886df6ecc914c70bd45014fddf8bf12d3d3b66431f24fddd9cc9bc56eca7dbe
-
SHA512
f0755421fbe403d91b7fa7e6469ac2d10c697ac6763df6d230b25a5703936a9592024b712ab86a26a5c6576a38b2439af976619cc8a6e2ca3a3ed1b725c1f9b1
-
SSDEEP
24576:5uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:r9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ccdaece63d6ac64a80d629b4600b457f_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\JPzM748g\rstrui.exeC:\Users\Admin\AppData\Local\JPzM748g\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\IE1L\dwm.exeC:\Users\Admin\AppData\Local\IE1L\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\jN7\dccw.exeC:\Users\Admin\AppData\Local\jN7\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d9d995119b90bf6a5a098f8f85218648
SHA12b6d5c380d06238fe5c6d8e628fb0543f127e185
SHA25683df501475e568d84d77b01a703e211ff461a775c4d7523c88dd9d272f17d29a
SHA5125d4355320c00de759009afb939a44c5870c4223f349f7b4afcd20d37bba9e10c9c53629c0788b42fd198c5b2c9d07291f22c9ff8533dc81aa63ae65847960a87
-
Filesize
117KB
MD5f162d5f5e845b9dc352dd1bad8cef1bc
SHA135bc294b7e1f062ef5cb5fa1bd3fc942a3e37ae2
SHA2568a7b7528db30ab123b060d8e41954d95913c07bb40cdae32e97f9edb0baf79c7
SHA5127077e800453a4564a24af022636a2f6547bdae2c9c6f4ed080d0c98415ecc4fbf538109cbebd456e321b9b74a00613d647b63998e31925fbd841fc9d4613e851
-
Filesize
1.2MB
MD58def97960f9f4c2ed19ca3da78f60121
SHA1e36954e0f44093ab3e923624f09bf0a46c29dc8b
SHA2568fe19e1b7f30412bc1d73a344ed399a55037663113f73784b1215cd9f738b382
SHA512738a9c0d66eddaf098aa043cecaa4e26ec9121923d23de098b5cbd4669fd596573c27d5b988f8972a387f29604b894a741c6549a4f1d8b2a65768af7eeeeffa6
-
Filesize
1.2MB
MD5a4728a17516e727586bc1158de99e4dc
SHA1669b95a1c84f892e2cd94458e857b9a55ca3c5c6
SHA2567a7609a440e9a1375c4dee2c182b353d9ed030a26d819997d00fe8c75212a7d9
SHA512c2a24b5be5f751b920612cd218b276e41461fe50fac0517135d15a0edbd04e0919f1c1062c7cd10ac1ab87d5d4997716addd3cb87010c3679f52725d015857e8
-
Filesize
1KB
MD56d4cdd7f0e6038ddcf8c46edca64b25e
SHA154bb61cba457d31c04d1283108cdccc0426b174c
SHA256e610f65066c2c306eafb6c16879dac2141779f1d8dbe0969f5f2e835a256cc2a
SHA5126be75774496294e874922e6b1b8b3f07fd1dafd29f01f7b1534cfc9003247a084931a86d1d212dd6ef78ca6696ca6b3f9dddc0390fdfe98271849c26e6a30455
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB