Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-09-2024 08:05
General
-
Target
e66310ce193bb89ced004896ce2abec0_JaffaCakes118.dll
-
Size
986KB
-
MD5
e66310ce193bb89ced004896ce2abec0
-
SHA1
873677347b25d9bc2296a7c0308e4e6139139592
-
SHA256
3c7d900f40f2d8d8a04b5e2d20279fd248a490df62ebdf7f3bdcbfeb7921844f
-
SHA512
aaf6243e666eee429add8022acbf9bc6e10f54de0ddfeb9bcb661bf87ab1c92d65e61c8799e2dbed708a11a0a7a81e25585c11af04937a3b9da2ee76697841e8
-
SSDEEP
24576:CVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:CV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e66310ce193bb89ced004896ce2abec0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\4PefqC\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\4PefqC\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\1gpz\MpSigStub.exeC:\Users\Admin\AppData\Local\1gpz\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\raluUTDwI\spinstall.exeC:\Users\Admin\AppData\Local\raluUTDwI\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
986KB
MD55e78ab2684384d09a818dafb927c97d9
SHA1eef21275900bb7c16c93ef7befff2e76fba19a94
SHA256d13fb85eb23b647def19ca4b95e45a48c5ed08013adab7422ccdba18a200e9e5
SHA512537a4698c8f315016c99e74c2d3a8f0fe6a967cb5ba0f0a0768b15bd543560807a0c82e2e782bcdc4dd2cef1338da3095892465af59a7b4244a10ad8ca05f08b
-
Filesize
986KB
MD5eb68361ea2ec32cdf71a1255bac3beba
SHA118ed69865215c267de4110e180893e494eed127e
SHA2562aee17f98a9d08a2671658d9fcd421cffa5b18640cc3bf6792dfaabbde45a322
SHA512b61b44bd61462913df53e5fa197cd2e230608dc1b2da5a8f7d7974c1f7a7ddedcdeb68e96f40e3ac1bd6a4198a485187a36d6b9dbf405a5f3ba848b94d0dc248
-
Filesize
989KB
MD5e901427276add2b149c75323db0d1661
SHA18f2abb482f5a09b5b1a793336ffd6296263d09fc
SHA25690677e10a6705c17bcc17325c36688a309cea87b3c8d29c9d3c0cf69a86e9ef5
SHA512cd4de20876bcec9994b949e3fb8d9fea810e03cdc2dbfc0777a1958d8eaf056081a0435cf9ec7a6011b2c1d99cbc599db61e2b03bf3e5fbf7acd219fd731884c
-
Filesize
1KB
MD532237f2ecbaac75421d99729962ab9a5
SHA115ec12c72c400e182960f4e444d9600946c7438b
SHA2569f67b533ac6a9ae931a0e6258181f8b81a1ed0dd1337491c8aa8474927705256
SHA51253262e0e4db0f9f402032bcb7a48d72b941633c2a2acd32966bdd3647b7c68052e9b18a6641ad9720e56e3758b971b6b2d5e4189ca083a48e87d5ff48c79b0d0
-
Filesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1008KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
1012KB