Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
31-08-2024 18:06
General
-
Target
cd52a36ef1f73ebca3e8bbb12b5f4a9c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
cd52a36ef1f73ebca3e8bbb12b5f4a9c
-
SHA1
5f7b23a06b43436f64d30ebeb64936d2816d170a
-
SHA256
f2f6b3965cee4f171cec6a3e05067252f127e466dd090fe5fd22d957267a2076
-
SHA512
0c259f41ba031cb19f74faab856f3afb89a7e82d6df0d5de673ef73e8e4d79a35342a314fe722c4dca81f01da60b4e608ef060cf16d2e118eae79ee79174b039
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cd52a36ef1f73ebca3e8bbb12b5f4a9c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wisptis.exeC:\Windows\system32\wisptis.exe1⤵
-
C:\Users\Admin\AppData\Local\1ZB6JfynS\wisptis.exeC:\Users\Admin\AppData\Local\1ZB6JfynS\wisptis.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\S5fPG\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\S5fPG\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\A7uZivEj\mmc.exeC:\Users\Admin\AppData\Local\A7uZivEj\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD519156764b0dfc49478f8c3c30cca98c8
SHA17039a4a426f96e0d821fba97452872bd2d8e9615
SHA25624c77a6286a00509a9aed3ed836d25b6a12a1ae36984876f435f594af614e745
SHA512fba34c743e58fc36ffa40301d6047a9adfeb4f7e8b928a9e2d9eb1c24073840a4d875769c6c7e049754c6357be62c853be6c05214b95b916ab048c470ef807c1
-
Filesize
1.2MB
MD56ba69075fad7eff7e6aec3d1387b7838
SHA151045c4b496510bbfbaa8a4b533f7f646c04f8ff
SHA2568b192c82e0f7490361c910740ce750a59fb6dadf543ca65ffbad0a225fc5fd96
SHA512913550a3c7cc6abc9f10a4609f182d2a69276557f4efe55ea9f978e8226d33587a692ee4166bd61fe69c1d8c4f64b1b4c798641e2cde11d4e73ab28c742bf46b
-
Filesize
1.2MB
MD503fd912d392f6b4b9210b6301e8eaa94
SHA190fc36f5a38bc0cd5871bac83eede4cb6d0ebfab
SHA256b14899c981cf902078746e0f9cebcd64091af1a857153cf8b6fd2a6fd78169d5
SHA5124dbe76d58399bed6e444bf76c9d838c39ca300fbfdfa443ccdff012ed5058c0952a01caaa4e3b3f882eb56e17fa83b251f431ed4901190b2de5cf061d8633b09
-
Filesize
1KB
MD5854ffba3adb7277d6e3bf194ebe8d110
SHA1d9e71e70266f8a3f474ec1f517f1e16dc3651c07
SHA256ca22dd7d0f1b07be15eeee5837176f78a0c288f3d1a87385fdce36c47377087c
SHA51277b7e7547230187e88ee81f483374d0d365e1419434bd49e99d3e451111936142e1326d1f4af1d97eca53475c8450971a8f6403e1609e6e2427edd0fdb9d3189
-
Filesize
396KB
MD502e20372d9d6d28e37ba9704edc90b67
SHA1d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA2563338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB