Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11-09-2024 02:59
General
-
Target
d97f80ce2a0f7b494b57d1cbb0540816_JaffaCakes118.dll
-
Size
988KB
-
MD5
d97f80ce2a0f7b494b57d1cbb0540816
-
SHA1
977f98ba04fb23584f8da01712f1bbc6c0737c3c
-
SHA256
838304ff62d092eadc72ce5443f3e1a93cd10520de99a9bc9cd04376c205505c
-
SHA512
e246b2d4d92262d6dfecbd755781b1655f816d2913ad1998491fb3062081adc400c4bcde7bcdb78c917ed7e5b0b97daf0769d56b1d414c90234f90372f58663f
-
SSDEEP
24576:LVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:LV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d97f80ce2a0f7b494b57d1cbb0540816_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\2segLj\WFS.exeC:\Users\Admin\AppData\Local\2segLj\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\xGYa5W\spreview.exeC:\Users\Admin\AppData\Local\xGYa5W\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\3P4m\cttune.exeC:\Users\Admin\AppData\Local\3P4m\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1015KB
MD51e4d4f98fc4944db7083403aeb6953b5
SHA1ced20cfa5e6ee4ec229cd90a0f6e847ed3cb8063
SHA256eb1cdf98f43a73b2bb416053eef768fe78577b0527d29842dc24416992cfcc83
SHA512ac29391a0445ebd535ad43c46f876859e539c18ffff95baa3518d5319a602d6ef472e7e7a0f2cf7b172fb80ce5c3ab747f047a8c1dfbe98e57bf0e25209b62d3
-
Filesize
314KB
MD57116848fd23e6195fcbbccdf83ce9af4
SHA135fb16a0b68f8a84d5dfac8c110ef5972f1bee93
SHA25639937665f72725bdb3b82389a5dbd906c63f4c14208312d7f7a59d6067e1cfa6
SHA512e38bf57eee5836b8598dd88dc3d266f497d911419a8426f73df6dcaa503611a965aabbd746181cb19bc38eebdb48db778a17f781a8f9e706cbd7a6ebec38f894
-
Filesize
988KB
MD566eb94b970c95a9e408e9ffe47ac61a0
SHA1f48c15c624266f95168af5cb18ae4efd251e9bb4
SHA256cc88a5e75d23f3f423f1f433f9db2178911f0fcce2240bb96107d324752fc34c
SHA512a5a0838c27c692f7dfe929a4848dd17e4498dac274d7b07690aba8e392ad5b6190812c395d664d747b3f439abe33d5c30a5513a2a9f3de8b6a5541d12a3a76b8
-
Filesize
892B
MD5b938c088c124187c1255633f740a6925
SHA1320e1a489ab61f6807ab5ec57d4274cc3fd8f893
SHA25692ad180f0e4d88a7e53e8b8af5956d814eafffec8893e3bb82dd94448b34c7b0
SHA51208f960ad6af8a2793171683968f940775c56ba229cc98b4b160dc634cd5c3dd54c7898f2e8afac8ef464a20b1069595ff8f8e4e498e314e30d755a178e093da2
-
Filesize
951KB
MD5a943d670747778c7597987a4b5b9a679
SHA1c48b760ff9762205386563b93e8884352645ef40
SHA2561a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610
SHA5123d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934
-
Filesize
989KB
MD5a8208143ea3200848813f7adaec1a24e
SHA15c0b033a811dd59ea1d193205f6320de89fbf335
SHA256efba54e165b88dfbcd999e7c9f4b47941d84d0d10400075299ca8185ac21f553
SHA512c69b222384a27a8610774b3a2820f0a3eb2cfac0ccfac3c0641a3469404f61d022da4e0ae2d14dac3e5d2b4bfabf6baed296cacbf160e9bc4caf550a1e68b7b9
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1012KB