Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-09-2024 10:28
General
-
Target
e69e1a73d6e6fb771bfe4de8e067f946_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
e69e1a73d6e6fb771bfe4de8e067f946
-
SHA1
019a67e5cf84aab2e0e3f97e82c85e123e8541fe
-
SHA256
cbe5154f2de0b6dff70341409f7f0a41e9c77853528736752887fa88187b828d
-
SHA512
dab0fe1150f8e28dc1e2eece414fe0eb2a20b627164d460e80c0d01daa0c560824eaf371f50f00c94ea0e474e2de860eec3987fceba720c4237ea491e8c426f6
-
SSDEEP
24576:3VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL80t:3V8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e69e1a73d6e6fb771bfe4de8e067f946_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\AgYFzHF\wextract.exeC:\Users\Admin\AppData\Local\AgYFzHF\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\rpw\wscript.exeC:\Users\Admin\AppData\Local\rpw\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\UEIklu7\wbengine.exeC:\Users\Admin\AppData\Local\UEIklu7\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD574ac9fbac85ea4288f844b756bd94785
SHA1f593673fcb8a094bfabf13558b4c0bf265f4d309
SHA2565c003e25f8f99f2a607c77401864c5ba280b6a2f63a8d1ce43ac782fb4350809
SHA5126c7e87f6508d4be45ac2161118166f79d0797d6ba64a283c5980242b77587636fcc5c1bab18e8a41c4764339a021a7f3fc235f7a435774e40d780530286f73a6
-
Filesize
1.2MB
MD56a9aeb309a9d4ed8193c00e3d6021f75
SHA11a61c468cfebef1e4b14f45f752f8d118831195a
SHA256d50030331568008ba245ce8d3aa233c98e0bf014dc30a5d80d85803d8eb65a01
SHA5128111a0855ed05e032b6fdc16f8374d1ee9b544c933e2c607d50ea40f6823e42b4898fc517d582aa52ac7b968fe6a6a6dfdbaf74fe35801ec411449ed6de87487
-
Filesize
1.2MB
MD5271f8c441a1fa09fcd4a9ce254557d32
SHA1ba5515dafaf771ca456285fc870e8b63680e07d5
SHA25686fff1d97b87ffb892583d7261069e9d5ed22738712c8c055ee3524aa9e75d75
SHA51284d56bffc25f52a623b142b5ec708331f7bc3ed5643d81c940176d52cc2c70788c9b364d1eae71ea2fd90f3a1313db29145fa7a4ba47374049160651838b6a1a
-
Filesize
1KB
MD5d5f05933982c17c1d26764cd96428ba9
SHA17a2291dd6ce51b06a515377c007851d4d9094626
SHA2567e0aecba2fbc098a224f4d55bef671c71e84cdd079392df3009b9034b5e9b8c7
SHA51216ab197697fd1c7995a2e711760305d1ae65d39a90479de6f09a2af557cba53ae2ee174e14081b94f0eb49890c79a1c58c658dd726d062cf0a20c2c8496b4cb7
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB