Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/09/2024, 20:50
General
-
Target
d7124391cb48a2dd54731363a0abc0df_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
d7124391cb48a2dd54731363a0abc0df
-
SHA1
e41176662cbdecf7e10bb93ae809932610f2803e
-
SHA256
43edfba88ac4ef39ede058afdd0640c659e3cf939a920c7f45449bf514ecd9cf
-
SHA512
14e4f489a3bb06c4a00feac97adbc520dc3cc4c967d20482d6d18f59f7b6e2fc175dc1e31579b5ada833f1b4983357c02f4361dec2ca7fc2bcee050cc58dfe1e
-
SSDEEP
24576:fuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:h9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7124391cb48a2dd54731363a0abc0df_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\CQTCFLNM\mspaint.exeC:\Users\Admin\AppData\Local\CQTCFLNM\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\x8fFkh\wscript.exeC:\Users\Admin\AppData\Local\x8fFkh\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\RZ0hyF3rn\BdeUISrv.exeC:\Users\Admin\AppData\Local\RZ0hyF3rn\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
1.2MB
MD5e8709b6bd82c4ce9b569db572c9e89e1
SHA141dab2d8a47dcf820e4f89694f0831a7c1ac20bf
SHA256c3a08106271faafe6a40f73525077647ea1ff6d40684399a0735947fa6b33406
SHA51250ba86480c0a99a0988d68eee94b1d59c589c6a7fd346544417d5c51d39d2fa8e1c13766b6861979ed0ff81fa22ee704bc2ba383de5dca9e93b36fdae92c9390
-
Filesize
1.2MB
MD583ffd8d5788aba2a87b6e14ad56b63fc
SHA1ab30f219fd5a72d0c7126380cdd665b0ae3d478a
SHA256aab1643683308cc5dab475c8e2492d35dd8ce44955744e2799892e44ffcc9182
SHA512a12e97a0079cbc3ca293166d39f493e0c23fc0414db6218e74ce87d66fb0642b32cc8e706677c6669e543d9ecac65408edb095c0148a3cbd3b24c1dfec843157
-
Filesize
1KB
MD5f3d2a234017a94ae5f832b6396826f72
SHA103f18f7f22d468530a9e37f349b26bd6518934ac
SHA256e4bfb9825a12d2fc6e806cf85b0aafb3eadbde591ebe4ff6760ca3d9bb7a7103
SHA512b9a161980e50edc50a7807033406d998052b2091d3165c1b974ba18abf120001751b67b61ad1cc1ddb1f7b7aed2ae69c1ce756eec0189becc6c8d7de03e58772
-
Filesize
1.2MB
MD50d563912e5b4fee67513dcbfa8a630c8
SHA10cbb53e693c1e74d3e2c0cad0597708d19bfa799
SHA256128a7aff0e5608dd2277afe9cccb00ea19d938eaf43c09816a73617ef933fe88
SHA5124bae39f1fa4a4a2b9f0f20d07f9ff730d4054b3bb9cdd6dba59ffd5f78800b34d0d974428a49d8ec3ae29fee605202646680114c530db11526beb202d3b4b576
-
Filesize
47KB
MD51da6b19be5d4949c868a264bc5e74206
SHA1d5ee86ba03a03ef8c93d93accafe40461084c839
SHA25600330a0e0eb1dbb6ee84997963f8e15c7c15c1df787f1c7f109609d7b31bd35c
SHA5129cee858c55eb0852e5bad53a675a094ae591b46b07afe9fb4224cac32e0be577fe36c1ed3e9f6bda4d4eb0c924a773d00e3181cd97f07e24c6c68c70f2b002c6
-
Filesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB