Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13-09-2024 05:00
General
-
Target
ddb96ccf588109bc1b46976e539b206b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ddb96ccf588109bc1b46976e539b206b
-
SHA1
2399f8c794e20b2f3dae8b299c2f067a9a873d33
-
SHA256
2b8d8798606bd8e1a6ed79a4ca0ce4fea163786b8b0232e0c4d52edb3edccc1d
-
SHA512
2f578acedb8be4dd594108e2d82c51098b3c467d76eee78dfdea36a22313bd7c02caf072513b4e7383a5724c999542936e40d9d0f2a7f685362d027adfde9db2
-
SSDEEP
24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:X9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ddb96ccf588109bc1b46976e539b206b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\UqF1J04\irftp.exeC:\Users\Admin\AppData\Local\UqF1J04\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\abYY2\mfpmp.exeC:\Users\Admin\AppData\Local\abYY2\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\zGF\winlogon.exeC:\Users\Admin\AppData\Local\zGF\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58cf1a93631500610b7a778dcc7663291
SHA1cc82c18871af2ac63fa0f65926a4f252e8ebbde2
SHA256101b4aafaf948e7bd8055c68d29be37c42faaf70d4a63aa2b3c277436cc668a6
SHA51235fb3622d91ab7375c14dda8f4b793148d9f2fbdcff355465580d92b88659e886d0042375ef26e13f2571f85d8906c4a874e65bc64b119fcea58807e33caf2fc
-
Filesize
1.2MB
MD5e4507fb00a632c69cc2f2fd20cdbcb25
SHA1bfa2cafb20fb33377fb23db400982f50f15dd767
SHA2569a4f5c029646366c5bba4c832626ba45cd34e4caaf05e65f7d01a2d95b58eaad
SHA5129a3dd894de8690e9de5fc1bd770f8f7a6bb3d99fec7c1b683d7b4d17840c387484c9ec9efb88c0073a46740ceb4e64d3283980ffe735bfee0aeeecdcf0007234
-
Filesize
1.2MB
MD56b45acfc922464ac70abbc832d9b92ea
SHA1e16041bb4b14bc99ec36b9826b751d2f37dc1aeb
SHA2566779af631d3247bb844aa48c6a50d48c1f39953da7ce767938f851b450742a77
SHA5120173b7869cb9eac19549f1aa51447c312fcb9fad09e02ea9cc048d00492a3943d71f6740c0d32b63c8ab0c31fc2ee5aa1b2c8c3adbfe2d35c7013da229d9089f
-
Filesize
1KB
MD579af5c019ec36eec37b8f96e4985e707
SHA1544e9f2608133c2dab026c85f77f11e6b3ad77a4
SHA25605bdbb78b18031f137d7e2005fea18c605398b252fba71b189bb61ea364ec0cd
SHA512ea6797ca99905371046f53a7b22c40db94783e573b764c33ad0dfa16fdb39b45722c11c502e8e3b4f152bc1894efaa1353ea1917f71b63924c034981ce171510
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
24KB
MD52d8600b94de72a9d771cbb56b9f9c331
SHA1a0e2ac409159546183aa45875497844c4adb5aac
SHA2567d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185
SHA5123aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB