Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-09-2024 21:07
General
-
Target
e35c61ebe91c031d45c2ae5fee1ce298_JaffaCakes118.dll
-
Size
985KB
-
MD5
e35c61ebe91c031d45c2ae5fee1ce298
-
SHA1
18f2b3c265c8cb3dfc839e276c8b991e2dc03eaf
-
SHA256
6da8b8e1b1f1db5c5497500cc342b5778541c2d6584a958ce64ae77c09895ecc
-
SHA512
9b29a54deec72ef1e8c713da7659299df77a842e4543b2cf2d09dcea30cc68e87fff71e629acbf76feaada6a6019ac79c9ea438c3dc3d00d44f731bc767e620d
-
SSDEEP
24576:hhLBOY3Zch8R9trbCPQFaD0JAc8V7M/GGS069NmgsSF:pTFJawGGj6fmg
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e35c61ebe91c031d45c2ae5fee1ce298_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\umLozn\Dxpserver.exeC:\Users\Admin\AppData\Local\umLozn\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\taskmgr.exeC:\Windows\system32\taskmgr.exe1⤵
-
C:\Users\Admin\AppData\Local\wb43\taskmgr.exeC:\Users\Admin\AppData\Local\wb43\taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\kJoj2Y2B\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\kJoj2Y2B\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
986KB
MD55dcfc0f90e555f578a6ddfb061a3d62a
SHA10b04925fb698532d4ee0218d88126b5cffee0fdd
SHA256e9a55c6d2cc4717d25e2f7efe3c7a2fe9c9b9ab3c6cb1b1d6b08195b1064ae07
SHA51256491d48f22373a060800692b0850a25ac97b14ac0223397e1b637c1c1c99f4b4daf5fb037e8681b73146ecd43b939ec267b498133cfc8fb79cdff52b7d6ef94
-
Filesize
986KB
MD54ce237ceab31031d3dc6a23e946cd28d
SHA1501c372a2d8033a43b97ce45e472507e72884784
SHA25638f74b1bbcced8bf7a0258743e3102742ca905de6c29bfff54792181bd583e22
SHA5125d711e61e22d1219d93e25373649276efe8fc667f3e3979f0d64c2fda715347199674fcc678dcb8871572fe8905b6742765701f0a2bf50531856f257923a432e
-
Filesize
987KB
MD5a336693b8ae0173c7428743a429c8872
SHA1fa4b75c66ef13271c588c5d0eb9f9219b53145e2
SHA256f292c64882091906041cff2109bd07adff231b056d09b7a71b198936c66eacdf
SHA5120251c214b557891b709a654d7667f793b0a08d2973e0f32a8d48b2af479c5d1f7ece73fd306f112885a20f358660a5654e8bdbaee5b18b9b758a47813d8ba95f
-
Filesize
1KB
MD5f73d9207727c78a855f1a6ee214be65f
SHA1c751c8250cc637cd7af81cba243661b05fd640ae
SHA2569140863c6b6ab7f36e63b2c5a3d94e23bbbedccb4cd81ad7d0b7219e8451c726
SHA5123721417448fa1cc17d9190f5c21a25e9f474e9b6f4bb60a2ae06a7d85c530305b50cc84ccce8a810c09f40ff5d357e5773e2f1538ace242b757932151901645f
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
251KB
MD509f7401d56f2393c6ca534ff0241a590
SHA1e8b4d84a28e5ea17272416ec45726964fdf25883
SHA2566766717b8afafe46b5fd66c7082ccce6b382cbea982c73cb651e35dc8187ace1
SHA5127187a27cd32c1b295c74e36e1b6148a31d602962448b18395a44a721d17daa7271d0cd198edb2ed05ace439746517ffb1bcc11c7f682e09b025c950ea7b83192
-
Filesize
1012KB
-
Filesize
1008KB
-
Filesize
8KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB