Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
08-09-2024 13:39
General
-
Target
d47ce92c9bd45f8eca1b81acbcb25287_JaffaCakes118.dll
-
Size
986KB
-
MD5
d47ce92c9bd45f8eca1b81acbcb25287
-
SHA1
12074d657002ae08f4bac4b2a77c46099d1233da
-
SHA256
25eebe3e58313adf7b6249667bb2be04934c816dc0ced46c61b4c18f645f57d0
-
SHA512
20a0b331e3c7b710e0fadf862b4b0b3687564cfe2c24e1ee056b9a7785c6e5c20506db60647d95d8d93d6706956a61f6ac976f534ca8facf42754bf2b2fc3a21
-
SSDEEP
24576:MVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:MV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d47ce92c9bd45f8eca1b81acbcb25287_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\kPt\irftp.exeC:\Users\Admin\AppData\Local\kPt\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\q2kkovK4\VaultSysUi.exeC:\Users\Admin\AppData\Local\q2kkovK4\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\Bn1\rstrui.exeC:\Users\Admin\AppData\Local\Bn1\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
986KB
MD581b5c45cecee9f432170a8a365ce0b04
SHA1198178504cd5588a701ac7e8aa5c11f280f49573
SHA2560887725fdaf08eba508c04b950cd6f84573c34a76e87b43e7662f28584a7128e
SHA51251b14a5255f80d822941921ddbb1ef6bc9a6387f3f0a54f8c05a70e5ef8554825e68ccd6eba114a198bf83ea76dbf05e0841e4832c5d3de872b71ec60f6fcaad
-
Filesize
991KB
MD55d663345d7b364bb959165942315f34c
SHA1c8294402ca73f2789a6990f3a7c461a9434d9f0b
SHA2560bc14b21a17bf382c55978eaa06fdee7061b30b9139d0d57782895fce74c3f25
SHA5120a27c57b75f59246bae70254be5b6bb53b39444c2401524f71b83fbaec7a8d32aa1687c6fe352ee83679682e629e28070b4a0f2b453a02bccede281fdecc410e
-
Filesize
987KB
MD5434de34b37e92f3921328ab32ebd1229
SHA116a0db0b8f72d3ae3672ed6769f01ad0cccca2a3
SHA256702cdecf988ebef4513776d8d5e6a35d5756c7d9b943932f65a85c79d453f803
SHA5121cb99ba28a1bf758113ec1aa2dbecd76029290da098d4a396726d6698a0e9a9bec30673809a3ad969b96c5f4f0868e76c7362568ae59072614ac98a9c01f5596
-
Filesize
1KB
MD5941f658e93f903305a5390a5b75af848
SHA1f5ee83475aa1b203ad8eaf93b287fb7ec4141538
SHA25645095896f635d4b0131ca5341087e424a833e5528d8c7d9dda7646397d563c3c
SHA5127d34347869e00fbf678ced4d178dc53094df6c5e776c8f5da8570c4797de06f9b5d75863016946494dbf543ef7d8eab2178fd6f9c3c8f9987613dbbcf5b97dad
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1012KB