Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 21:50
General
-
Target
e11bf282fd9be970031baf9797a1379a_JaffaCakes118.dll
-
Size
991KB
-
MD5
e11bf282fd9be970031baf9797a1379a
-
SHA1
1f7d6162e6ded5db6199dfb1274c2849a0a48657
-
SHA256
32e5d40ccc266ccfb480fce21f10220a42dcf29b437685b9355b013aa4df6e05
-
SHA512
886a68d0ad35357c25dd0511d8a9b84eb06a46a499b7e6c28ab4a5300f0c31ae4a598456b6e49648db1b01beaaf76730536336a35f675d134af71ed1723e263b
-
SSDEEP
24576:hVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:hV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e11bf282fd9be970031baf9797a1379a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\JwH\SoundRecorder.exeC:\Users\Admin\AppData\Local\JwH\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\ygFKKR880\sdclt.exeC:\Users\Admin\AppData\Local\ygFKKR880\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\0C3OB0\msdt.exeC:\Users\Admin\AppData\Local\0C3OB0\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
993KB
MD54fe823d138ba98665f7464e01c163c26
SHA163abd5bd2f2f54fdc07a6cb8861090254361235d
SHA2560ff7b0f6913afd35fa1030774a97aa598fd41e97f69a8bd56cecdb697b50e4f5
SHA51240dac56d50285843f8552d8ba796a71adfbdbed35cfa0bd8f887f5c43f0d8e20dae5af2cbf874f1e1a9b7f2a9f06c68134b33c217c71d73c18df436c735aa50e
-
Filesize
996KB
MD59aeda448dfdf696102461d6db46d9e31
SHA14e1e0736c21c21079af186123c3e0431019df83e
SHA25636e36f564a2ae73598d9c22efc6356936b66035eb5c8d65a0e8cbdfbe74ad583
SHA51296df0aa2144330c3f50a468d4b2ba631d23aa3aca6249e8f99304d160a92e8090fbc005ee4240a6b03c95da6f0a35916bc8f1b355cfe0fe80525a0ca413d25a7
-
Filesize
994KB
MD52dcf07c5b42b49881bfedac1d59f9d04
SHA1d01c3682aa747ae68d929ad94bff6abede3e3b1e
SHA256ae8bd565eb7bc4424104dfe5d2da3c81855634f0580da9f38c5553fc2d8ad752
SHA51270888d0dac7ba739a5b05f1b259f7243e168ac6327b03d719c474be8892259afa27321e7149a8f3ea3345f4911bb0e52899837c3b34590a88a6712589366f0e5
-
Filesize
1KB
MD560bc61e01fdee50ad3106cf15c0f57b7
SHA13a47063019fbf597172a3482bfc65013d24e070e
SHA2568ec1d28e643a12622988c8f0a69e1f149006b09f179999fe9b304ba7181da8b1
SHA5120dd8e0991458fa9b9dfcf24971bbf3af2071558b2f6cc810358824d6575d515aadb6dc3fe6d0f61606e783db4a0b86c00cd2876c88b41ee0816085f90058df6b
-
Filesize
1.0MB
MD5aecb7b09566b1f83f61d5a4b44ae9c7e
SHA13a4a2338c6b5ac833dc87497e04fe89c5481e289
SHA256fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5
SHA5126e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1016KB
-
Filesize
28KB
-
Filesize
1016KB