Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
08-09-2024 15:42
General
-
Target
d4b352a768590a50e1a05ed9d448532f_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d4b352a768590a50e1a05ed9d448532f
-
SHA1
4523e3c1119bd266bd2a37e79891bac697394778
-
SHA256
3a73e3bcb1526fd55c631a34ac7496450411304463378d110c51e4fabf79974c
-
SHA512
830560117515b2a5173a6185588d9d68f97cfa640eea06b2aa3ec550b6fe61e10bd18955bd3b04a6a48fc12461a9474466cb341dee2b7cb416e37695fc276e7c
-
SSDEEP
24576:AyTonNVlKTt/Q5ECvVP7hpJMvjtKpvPf9+m6kLRqgSyI:AyWRKTt/QlPVp3h9
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4b352a768590a50e1a05ed9d448532f_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\x5lrjLgL1\msra.exeC:\Users\Admin\AppData\Local\x5lrjLgL1\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\I9zSlCRFt\shrpubw.exeC:\Users\Admin\AppData\Local\I9zSlCRFt\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\cSvUPD\SndVol.exeC:\Users\Admin\AppData\Local\cSvUPD\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD54290d7804d2c0289963b212d75ffe52a
SHA146265ffc84fde7cfbf0251dc647c7a78d72a13fd
SHA256c8427cdc5a681aa620ad168b3402f04527afcd14c683fa057d96c85739027c38
SHA5126c83dc0b7b1b00355d56b4640e077a64a639577fec8e5942b2bbd6fb5cb00b19cde3b5cbcef351487039d1150c9bc2a22ccf30315f35d3d11a0554b43f589bab
-
Filesize
1.2MB
MD5fc93908315bf46370a93245911c05f1c
SHA180f06556b322e831ba7def947581548db3896927
SHA256178c324c83ebb96529013c398736e9af8715185d40a67c680f7507c92ae2af4c
SHA512602d7af24b63ad7a3a19c248ee7fcfd3f0bb03c2b6a1a3560309070f7b0d2a4d2e8ee0732b69a8104b695362bc749fc7f8d9577172fd128cad6f00349d6d0c40
-
Filesize
1.2MB
MD53661d051a7987102934aec0f5691b304
SHA16f66ef86cefaec121e43a8f8da6c16cf2bb55bd6
SHA256bb2d38af28b7ed54f7a30f1001df226abb2644ac48186ee8d0b4901dd9a4c578
SHA5122ee360ffa3b322bb21b485cf131be375aa224c434d368753e7dadcb3749731490bb93d6fbbba85cc383eaae4c5b5fdb63bf8469f47cb7a33116ea1f65f92e1ec
-
Filesize
1KB
MD5bc736f41e8dfa54980c94e4a257f7ede
SHA180b086f511d06a1ae357f544583c81663c85df01
SHA25620dbe5e4dfc3e8b7922b9cc08f92198960032e9ff17fd7a1f3662bdcb9467d8e
SHA512943cd33d3d57d45973ce9124e1a041efcebccf86c408628170387dac52d202b877e882fb91552dfd7d71b6c012b1c4435e00d33a11a4b0b9810981eabef5e455
-
Filesize
398KB
MD529e6d0016611c8f948db5ea71372f76c
SHA101d007a01020370709cd6580717f9ace049647e8
SHA25653c868882ebc9e0d4f703afeccb172043069ccc0b5b6f7cac1d2aad9c4640930
SHA512300216ab47ee44b8f68d4835bf26641f949039522b680af00fb602f57d31c38812428dc624461bc2cc7d6384cad396bc033718e41e11a65f7dd0eeb36ed924e4
-
Filesize
267KB
MD5c3489639ec8e181044f6c6bfd3d01ac9
SHA1e057c90b675a6da19596b0ac458c25d7440b7869
SHA256a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103
SHA51263b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB