Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
07-09-2024 15:33
General
-
Target
d24290c72ad04d54e46acbe21b617c43_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
d24290c72ad04d54e46acbe21b617c43
-
SHA1
b7a91df70b0620b578a3d709b5af18b2d8eb8f33
-
SHA256
c45a7ae23c315e0e5cb56d1bfe89d4a5ab30194c99f6f16b814d246f787c24de
-
SHA512
d07efe41fc582b3d838d6e6191af14737b9733455bb57baad38a77aa066cb8a9dbd36678810fbaf27cbf8bf9dffa59529dd9f078bd32e4131c4da5dffe835da6
-
SSDEEP
12288:VdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0TOt:7MIJxSDX3bqjhcfHk7MzH6zyt
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d24290c72ad04d54e46acbe21b617c43_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\mypJOrI7\msra.exeC:\Users\Admin\AppData\Local\mypJOrI7\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\XWbCY\tabcal.exeC:\Users\Admin\AppData\Local\XWbCY\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Sp4\winlogon.exeC:\Users\Admin\AppData\Local\Sp4\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD55112470516e71ba42272174548e2e3d1
SHA173c9dd2e160ac67f6e9cfcffb88a82f203e5727c
SHA256a3e1c3361e2df236f58f0320545398ffd42b0fa07f0c1ba37a64991f101f4de1
SHA512fddb4bb860adb67bda4e782c2a20286f7f0d739e5dcd8a467045842732eeb8ad382b9d0eed47dedbec53d6c53e240dd12f62ac78e6081ea248742fec942b15ec
-
Filesize
1.1MB
MD5df7f7a9c61966b68cadfb8dbb6d3d034
SHA1ae69e8af262fa68157e61af2f4d700cee12a74e0
SHA2567639d0c8ea8f0aa6a9f089ec887dac0164670b6c0defd316017e77198483ac08
SHA5127257f6f5a039ec524fbcbbb9f87a2742fc1f165208f4ec7decad289780cd9d5a31abd711e1cf51cecf25c294a8d8c9ab0be84e2026274f9540e50cae05ee67b1
-
Filesize
1.1MB
MD52d96e61b5abfb873748a3fd798c97357
SHA14f3ea1978f15a93854564444c17981d32d0a721a
SHA25618043e12fdca0893601f736cb22e96912404c0fcff959372feab376e55f07170
SHA512cecd4c53a5995e3f8bf548b0735a54835708120b96d6dbebf656ad08e0b4bdac349370288c77a8e82a5a98085b2c026cf023328be1bc05ac97da8550e45d0428
-
Filesize
1KB
MD583712064b379bd22b7c33daefd770c57
SHA1e205ffc68959883c5ec1ccfbfe5d0f5c94c59b75
SHA25601b50104fc0afe543d5024af7a76c896f4da85231b61ceaef906e7a9c138192d
SHA512f28286ca6b1a724ca08a74f78b0c071fce1527d5e412a358a3b8c9bf2ec74f3ad22a843054e9b5ddb0c7f5be5b6af7bf1fa4a05735c67915819f1c374fa730a0
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
77KB
MD598e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB