Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-09-2024 20:33
General
-
Target
dd004eb1995ca16c41612ab17fb29d16_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
dd004eb1995ca16c41612ab17fb29d16
-
SHA1
3a75a7c007771180bd4c55006b3f60015fa96b8d
-
SHA256
720dda96ea558310e2dd575d2dbd382caeccff1c8a71299b091f293845bf46de
-
SHA512
8ac3e636b114189eab565f7d68f634e989bee34a48b5d259af724c55df9dd4ee70626559d3f73f302de78a605a21e8b0ca88483d8efa1e15cc920c5812e0516a
-
SSDEEP
12288:8VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:JfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd004eb1995ca16c41612ab17fb29d16_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\4vj\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\4vj\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\KMB\sigverif.exeC:\Users\Admin\AppData\Local\KMB\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\m0GTfOX8\mfpmp.exeC:\Users\Admin\AppData\Local\m0GTfOX8\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD54ef540c2ac1b0f0de474cf58ad19280e
SHA1d6fef56230b035c6245db72cfffadb6a8fa6e731
SHA256309f39c89d5c0dbb600593c7e1e7336221510f8ddb6a0d80adb9b092795f74f8
SHA51264d0de56b22621cbca7db3d821497731c6a85ebb2c4abb3c56432a27638acbf8c86987869a18576da64f3534bd4f1f89c6e7a460f6366f3d771cba79caa24a6a
-
Filesize
1.2MB
MD5086575e238a6620d72b0177b143ea703
SHA1e9e8cfaf3769b5318a070f2b4312d64af2d724ac
SHA256f63bcd300d3c9bb2d863a5e7b10e3deb7422a9fab7ee1792935c5a29a991936f
SHA512be008ac26987914d20b46b284f42d0226d5de9dd6923dae0b8fee2127b7d588d24320210a233c5e2ec683c8816670dad1c4eec1a040c283f5028792f3f387efe
-
Filesize
1.2MB
MD5946d67a0b022dcd902794a322ef6c5b4
SHA1d4007766ca5cf63fae026cc973d5f8f5c912bb59
SHA2560637e086dbef9f7832c9f7ed1d2817a3029ab4b2f672aff005740de9b216a0ce
SHA512dd2ae0ab89d07372151a9cd6e5725eb9c5a953886d26c37bacfef64340ef4dd9263966c220738e05b228d0bbd03ac365a5a891ebed93184f8c5f9157b75d972c
-
Filesize
1KB
MD585bb275ffd3b5832786feddccfa6a3b4
SHA196943cfd94acce049b41655c319e375e147067d2
SHA2563eff32a7be8d51975540be15a4c5a53110b8f9f1521f88806f4d1742e975ef8d
SHA51279fc2584fc3efdf3e66ef694a4c4ffb81eb60b16bbb408791392ff11aca96d0cc8e3147d882f4a93d92f6e8d293e7a3867b07f8141c0f5330a8430deb2cd6782
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
73KB
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
Filesize
24KB
MD52d8600b94de72a9d771cbb56b9f9c331
SHA1a0e2ac409159546183aa45875497844c4adb5aac
SHA2567d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185
SHA5123aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB