Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-09-2024 20:09
General
-
Target
d7046a77abea80c3feecd1943072d1b6_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d7046a77abea80c3feecd1943072d1b6
-
SHA1
d9896c3622da161c675d7ef431325b7fcca71886
-
SHA256
c6925804ea54a33bcdcc830d09ffdd297160f57775da5c00d32e11339e07730c
-
SHA512
3493cc0763646606dbf3483df2b6c76ed45b9412bf45f6cce0b499eb047fb209c0f84414e2a60ef5c8e2528c39241147467ec2948be4405aa8acd52e01b2b187
-
SSDEEP
24576:suYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:E9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7046a77abea80c3feecd1943072d1b6_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\m5VRGA\wextract.exeC:\Users\Admin\AppData\Local\m5VRGA\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\4iu\unregmp2.exeC:\Users\Admin\AppData\Local\4iu\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\b2gpH1Ug\msdtc.exeC:\Users\Admin\AppData\Local\b2gpH1Ug\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD56865214df30fb9c24ca1d28ebdb3969d
SHA187a4ebf677242d7de6ee5cc22627de586e1c7803
SHA25613db09d976fc5e6c2b1e49a55869f6cd7fe2dc75f496d9e1ebe080cd08b9555c
SHA512ebc4a7ef9da7e0564798a831234efee5f845cb904665820165051625546bb6d8ee0219df5516b63fa1cf4a8d3c25c5ce1d061f0b55a9008469bb827efed768f6
-
Filesize
1.2MB
MD58841faf1cc896802cde9ee67d45a9beb
SHA1e57c040b088c02e46920fea7ab452c55de26fa7a
SHA2561a8d8034c313461de7fe0f8ac56dd6906a35d2f7fd5e591ce648d64fa684ef59
SHA51296386361f74699db17d93c2fd5d2cc6facda64ff20eb1caf26c0d129c21002d6b6210584e7d84cc7a51394ebb2f896003c41306c62223d33cf76bc95bd4ccb74
-
Filesize
1.2MB
MD5c2f6481a96fd34477504125c5b139ef5
SHA154476c439c9dc811a8adb4d86a66f8a266c1d12e
SHA2567fc9126851b01892e61431aaf6d24487b768fb17b0ff246793efba7e0e27f593
SHA512966ba045d38cb977b1ad83ede1207e7afcc4661a5e939fecd2f022de15c045e7ac775f1589e272d02736d88218799a30bf29b2862601987c01e6aeabe8e3caf9
-
Filesize
1KB
MD592698312d3282b96f8da9252c142b0e4
SHA1684c0deda339b1302b4197486d1690608090982d
SHA256a5ef043f4b2bb25a400ab100db3aa4863f7dc2677caa119a4370779763188100
SHA51266f0bcd0e644745f50c2522525618674ce67ceaa3d65172e3210e8e02bceb1eacea5d5a1751135f5dd699eafa2902da1c86735705a2f94715019ae888c3f6e90
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB