Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-09-2024 00:03
General
-
Target
e5ce7011f68ebaaeb173f310c34f87d2_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e5ce7011f68ebaaeb173f310c34f87d2
-
SHA1
b64a4c56ef7f6a6576a0b0f75e3e271a28722d16
-
SHA256
5201a4cd5b69c5e49689be7361c07bceaa2cb9bf8be47e15e44acd582f814359
-
SHA512
4068e1a6ce54d215266a717be3760a21000776f4b9e3f595d5720230d68d8609f5c54e43af922200671353c8d3401433a0b9d80b6a2a475efd5f3ed326d4073d
-
SSDEEP
24576:SVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:SV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5ce7011f68ebaaeb173f310c34f87d2_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\Ir3alg2\DWWIN.EXEC:\Users\Admin\AppData\Local\Ir3alg2\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\MHhjFp\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\MHhjFp\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\yumnMG\wusa.exeC:\Users\Admin\AppData\Local\yumnMG\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c92cca35b9e585b061a2f03d6f99abd9
SHA1a8612ba6e973a2ae4214bdb5b0ecdadd13e02d75
SHA256858403c7ed16d5ec3fceffcd6a4956006c665cee99524aefdb1b5a68ea8f4574
SHA5127d412e61776118d296941269df6b306ec850cc1f636ec041b31f54c7316d9bff013369d0e1ecd51598d7c6074b9f5776c070f739a6a60c44b1b3d1fa68bcb920
-
Filesize
1.2MB
MD50ce432088b34d259019077cc6a6a4ba1
SHA1d1f34da4b9ca0189c61520f77ea8f39695e9c5dc
SHA256af11fdd79860336ecc96c0d50369e6c01723aa298517f1e4fca7adfd44a9df47
SHA512624bf99531370d4249a3abe794b71565c676d800c85b6ba50a489401b2fa058c95fa82c706a493a99cf97025f500192f819d344e6528c830b394faff9ad5ca79
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
1.2MB
MD597cf0af0fc424d62cd23eb5e6e5d0297
SHA1b2dbe56ce2cc3eb3600e5a2222ae489ddb2634ff
SHA256f0a158f6592d8c04a8611ee1f11928148d8db7738567dd28afffd95b80ecab62
SHA512310376271a699d12e8bf5ef727d4be22a948b38c15699f975873c8eec51ed67afb95764128c1e224972c39df43775be37010927e7d5a0d8bd3b2ca7ef660700e
-
Filesize
1KB
MD5dd8068e2a208cdc01caa3ee9fc9d871c
SHA1ba559b3a5c9d8bc2f4b97801d5ab4ea0a0b47513
SHA2561146ecc0fbf5998548958308185a4d6b44009d96469ee500e9bd30a011f3d998
SHA5125546a149db71268d5dd229ac9109167343610f60ad76354a4a29b0d1599d792eaae18e6a900115e82ec4d10a084a15bf64249835cd86ebb4cb4ccbdba4c9f62c
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
300KB
MD5c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB