Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-09-2024 12:27
General
-
Target
cf87a56aaa2dc88e7682b33d3a6e10a1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
cf87a56aaa2dc88e7682b33d3a6e10a1
-
SHA1
51de1ac388a07d0c3a25e3ee0a807a62e5494b10
-
SHA256
5a38c0f8a4964449b78f6d1a7e9685cbf59f04951226ba93e772db38f3709fc6
-
SHA512
cc2729ba0baf0e0ddca898d028557136829b317d06c962e1c02f90af7227aa15fac0979c473cfa3b19d70b9aca9382656522a008ad243628e9124c89dc5331d9
-
SSDEEP
24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf87a56aaa2dc88e7682b33d3a6e10a1_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\9RPsqq\irftp.exeC:\Users\Admin\AppData\Local\9RPsqq\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\7qq\MpSigStub.exeC:\Users\Admin\AppData\Local\7qq\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Rp1plJKb5\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\Rp1plJKb5\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD57437586171f72654346be43119f8fb10
SHA1b0604cf94668a92f6c7a6407bf29d7d525bc46b8
SHA256008dfc1a6b41965097d5d1bed74633d3f1009640c5138b27854c6dcaf1b6c05e
SHA512ab074f6abc51154ae4069c484522eac7acd8a0f2e986388ab552aeba1cdc441cf8e7e345b6d6129ac40b39acb699d25d6bc55e00bb4e05670e8b094a1ab65058
-
Filesize
1.2MB
MD53b045ef65aa5ec92c9f2845797850dd7
SHA10ba38b8c3b275b4b78c4e5881cb7e5d76c582b9c
SHA25639733da258cf5d74fd9f1a3046f43f331969b1abfd76db659462c58182f7ee8e
SHA512b467630010316e0f84eb74a9c4c90157d1b1be77762f2e1d5bda910fa4fa7216c056e5229a12220df1c0fccd487141ca4a7ca40272eb429a3a6aa1e281ce47b4
-
Filesize
1.2MB
MD5170663459c9bb5a893977d0e9817bf48
SHA1ecc2042e28ca50e7fb4428ab4978b0b2e28c2a9f
SHA2569bfaa73fd47d3902b74187f0e4c422769bf050aae4448060f1ecf9627fe5a9fd
SHA512cf8611aa721ae9697bea1e64831247e822ed7a073ad173a7ac96e4a2d599c97f779f0c0dda5cd2814575f1d93054975035ce9992438da3f00cc711e5114cadd1
-
Filesize
1KB
MD56e5b9c41443045e0d59d55b99cdf4719
SHA1af373cd4786a6db989a50b1d6f3c300078fd7d1d
SHA256d2926584df9cee072028a58b24af0b0dca02f04bcf87845d84a18586e50caf2b
SHA5123ab7086ab8a1fe452dfa302b108d6c8b4773170c3e4fa8dc084f0447e9c0aac9828d4064c994af339e42c26a642b6dcfa8469d4aeb1ac2cb6f76be1d890f1745
-
Filesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB