Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/09/2024, 23:46
General
-
Target
dd4291c04dcea049af1211bed4fbff12_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
dd4291c04dcea049af1211bed4fbff12
-
SHA1
99c7c1882b1adbdca93d40b6d1bb670abe21cec0
-
SHA256
16e713fc83ba72915d16505d5350d1ecc99f13b3cf71b714da0471a8272ce5b5
-
SHA512
db7107eddb7b2291f936c3bbb3cf7a40239b6b4a041abad9707b5b0479bf6aa58d40be60647c01bd8ba05f8a7128f1d635cdaf8ebda70423e96a77f534a38339
-
SSDEEP
24576:ruYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N0:19cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd4291c04dcea049af1211bed4fbff12_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe1⤵
-
C:\Users\Admin\AppData\Local\4PO\AdapterTroubleshooter.exeC:\Users\Admin\AppData\Local\4PO\AdapterTroubleshooter.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\vmicsvc.exeC:\Windows\system32\vmicsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\wns02A9MC\vmicsvc.exeC:\Users\Admin\AppData\Local\wns02A9MC\vmicsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\5KtBnwcL\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\5KtBnwcL\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5963e5403d5d11a4caffbdd0740ffb1b4
SHA174475646825aeb0110076c0fbc5b67aca780b813
SHA2565c7e229a1fab5cc89d41cc0183daddabb20dec4d59f664262f75136660a008ff
SHA51297c2ea67d135f1eef1bdbb5c9fc998069addcacf390ed6e4fe227c8840613dffb49de32d77cb033dac462e21e6e3cfd8a2ad2046f4b599fb948fb74dc319bbcd
-
Filesize
1.2MB
MD50f6f17f198df529fc281aed71be38bae
SHA167f837dffcd1184e870df931a4c417a1eea60636
SHA2562b934f8047bdc38049e7b82557ad34079f005157a0fa5600306d4c8c70c25505
SHA5120f37e19bb0478b8d1b75f6471a24df91d0023e2b9769a5979fccc5d1b9becbb68527f55ee2a701a7f7974214d217e498223d63c58b1c26e55f80f17dba9b6f20
-
Filesize
1.2MB
MD5f8917cff536bf09209dc07972f7252f9
SHA1c3a8a243bd0f11b259ab0b384f9f3b738e6021df
SHA256ec4e87399fa69ed9154e11a45ce31f41b6df266ec584358de12e58d7c834497a
SHA512acb32c52dfbe28e13eee1550bb5004e0d3a8525252b805222b5b9ce5905ae03c70fbcdb1f9429e7659e80d8f801c21955840ecedf6d4ab6c3d73c39624aa1d43
-
Filesize
1KB
MD5a7b6f4dc74574578f285f4c7d3eca4d0
SHA10b65ba520bd9dd4b3cac6de8dc767443bde22995
SHA256df66885feca4b050b46c57b736a2ddb2c31c39f888081812b7e9707c4dccbdc4
SHA51226380874b36ca2afde01247e366fbc151aa64d3e675a468627de49d790151fd2f333fdd4e7eaf880564da6b859df2e0f045862b6afbc250575afa5b4c1412ec5
-
Filesize
39KB
MD5d4170c9ff5b2f85b0ce0246033d26919
SHA1a76118e8775e16237cf00f2fb79718be0dc84db1
SHA256d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da
SHA5129c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
238KB
MD579e14b291ca96a02f1eb22bd721deccd
SHA14c8dbff611acd8a92cd2280239f78bebd2a9947e
SHA256d829166db30923406a025bf33d6a0997be0a3df950114d1f34547a9525b749e8
SHA512f3d1fa7732b6b027bbaf22530331d27ede85f92c9fd64f940139fd262bd7468211a8a54c835d3934b1974b3d8ecddefa79ea77901b9ef49ab36069963693f988
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB