Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15-09-2024 11:39
General
-
Target
e2653dc54e2257c34dd7d16ae5f9d1b1_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e2653dc54e2257c34dd7d16ae5f9d1b1
-
SHA1
3de7fed00d1161d0e06c802a790932e9c5aa7cb8
-
SHA256
86f7814d9e9ee52f35aa907f6a1a8da5afbedc5190cfbdc358c090c59a0bc7e5
-
SHA512
812df21cd838255f041e17610c1b37069184fc0b217b8bd2cf7c6dded45ea41a2bdb9c4cdc507fba111905dc7563810663759fdcdd3b41d8257475c7d5b0d96f
-
SSDEEP
24576:FuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:/9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e2653dc54e2257c34dd7d16ae5f9d1b1_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\oqlx42S\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\oqlx42S\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\b4d\eudcedit.exeC:\Users\Admin\AppData\Local\b4d\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\BJX4u\cttune.exeC:\Users\Admin\AppData\Local\BJX4u\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5510af3096cb1f23c8a860d729d49cdf4
SHA10d895380aebab357d88cdc098d7c678a9acec0e6
SHA25604503342f96b39cb68f0da79621badcb547dc3fc8fd28edce4de903346b1d7ac
SHA512db845a529d3523c768ffffd6cc6f965ba76b995a8d1041b25881628ec6678e5e65f8830775550b0fcb582c770cc7931ee03db21b3c0f79844e0543179ed6148a
-
Filesize
1.2MB
MD5d4878f161f317b91e2eee4aefe221b53
SHA1ef70fcb37423f03d38c889adff2cfb94d78e9a9f
SHA25644bbf9e0cc68716a3c9183697119a6e5d217459e8defa578f4f3a857a2c93c47
SHA5120da08568aa785a4368731d1bbe8a4cac398ad4cc19244d5b050675853c8e3b73d5c69ab4da7f9a6c4e8b959f7788883c3d6692d9d9d5a2e7281adca0b8717870
-
Filesize
1.2MB
MD55af46fe9bec136ae48108814749503d6
SHA174038bb249e0d9e69356bbbc938c2748e587a91a
SHA25631268af3bd4c129d1e96e48ff1961a8aaccc52c4d4ff14c3efe611a343435e92
SHA51273cd869783a04a3c76450dc6a7f7fc9c462ff796cb4d575d01b0b8de05ea8d41eb88764f701fcabb315acfb384fc8e844e29abccc9b272fc2b4341472f4003d9
-
Filesize
1KB
MD543d03895bb87773da9defdfe7ee08489
SHA1b0c06499b3e0ef3f49765b74da07c766073afaff
SHA256936031eadefa1bf2c10fe40cb4f4e99423ebc283593ca7aad1be4c92b8d18936
SHA512be86e10f53be0bde78feb94ccbd7ea13c83bacc19925ef2304df76664c582dcee1055e8954d961ca21891860439a9cf7f29be6908691b3b9e6ab7b3f45030194
-
Filesize
314KB
MD57116848fd23e6195fcbbccdf83ce9af4
SHA135fb16a0b68f8a84d5dfac8c110ef5972f1bee93
SHA25639937665f72725bdb3b82389a5dbd906c63f4c14208312d7f7a59d6067e1cfa6
SHA512e38bf57eee5836b8598dd88dc3d266f497d911419a8426f73df6dcaa503611a965aabbd746181cb19bc38eebdb48db778a17f781a8f9e706cbd7a6ebec38f894
-
Filesize
351KB
MD535e397d6ca8407b86d8a7972f0c90711
SHA16b39830003906ef82442522d22b80460c03f6082
SHA2561f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde
SHA51271b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e
-
Filesize
80KB
MD5bd889683916aa93e84e1a75802918acf
SHA15ee66571359178613a4256a7470c2c3e6dd93cfa
SHA2560e22894595891a9ff9706e03b3db31a751541c4a773f82420fce57237d6c47cf
SHA5129d76de848b319f44657fb7fbe5a3b927774ae999362ff811a199002ffa77ad9e1638a65a271388e605ab5e5a7cb6ce5aa7fcabc3ed583ade00eaa4c265552026
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB