Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-09-2024 13:38
General
-
Target
e6f0b105457870d7cd16f84f233d21f9_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
e6f0b105457870d7cd16f84f233d21f9
-
SHA1
9bc3bf0208c214b1f8f6704e94cd9741e561bd62
-
SHA256
c1740bb33bac0ad1293f0e1305ea99e8b0d7719f7a02f0d12f719d48336ce1c0
-
SHA512
80690bced2325abefa50e01e3051e150b452ceeaa573406d753a78e9176cc0d0ea50b320ad94311d2c278ceb01a4de821a256cd28b989f3019467af33990f551
-
SSDEEP
12288:sdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:eMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e6f0b105457870d7cd16f84f233d21f9_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\FTP7Z2ZWl\msdt.exeC:\Users\Admin\AppData\Local\FTP7Z2ZWl\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\HWTFc\rdpclip.exeC:\Users\Admin\AppData\Local\HWTFc\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dvdupgrd.exeC:\Windows\system32\dvdupgrd.exe1⤵
-
C:\Users\Admin\AppData\Local\xYObte\dvdupgrd.exeC:\Users\Admin\AppData\Local\xYObte\dvdupgrd.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5a116560ceb35da27158e85f92913f763
SHA1bb7f14975d30a3846e08567d09d8e4edc5850ebd
SHA25672f9662a92ea24f87930cdaba23e22cdb24d2062e363b42e606129929fbf1add
SHA512bc8869a07b4299c10cfacfcdd2f212d8a80ab5781d9f7faae6d359afcf1401cd9aa71c316bb682d2ea2cecfa2fc636c566d17473a5ae7f8d223308f013468907
-
Filesize
1.3MB
MD5562575cc0c68f7c2b3b4f740fabbc43a
SHA1405004e6008d99efbe72171c55d57f00ae007ec2
SHA25636ebca1c957c13b8c135d8bebd6c6a8e67b4d3d3d2f711c7537a8c5ec2475c04
SHA5129aa32befdae44105844bdf0c04eb0c866929d1070faf63b55352732deaf211dbcda6294864f0814437be68a3e88b4127f776f98ad58fc9a5055837dbe466d886
-
Filesize
1.3MB
MD54830c4772647f73a8b96f92e01ad5610
SHA16e94383e3f453887e0fb218f5066e1a832095386
SHA256abf496c4466250a68d1d196d4956c4d714d6990c77fbad0c270b613a8d4ec363
SHA512f67d2dab8f15f9dea8273b882311e0ae5b04277594e6902a0a7d036fec09d9131ea2b3e3e85cc33b52c79c59f8e5d73cabf1e9be5817f72595b36398976d90e8
-
Filesize
1KB
MD550068e1d306ae1aaca280921151973db
SHA1b13143389f43db41f6838e779cebb264b27c2993
SHA256c30fb0773f019473aa1323f663f262579b88a9d36a3dac5ffd5195af2d37b4ed
SHA512e6164d2b9324e568334927a1c4c590e6c8d1efcb2a775498f1744bb512f3665baa51bdb3751e8e4c59a5a0d03126b16096b7fd41f3863a3d77362340c1f0e748
-
Filesize
1.0MB
MD5aecb7b09566b1f83f61d5a4b44ae9c7e
SHA13a4a2338c6b5ac833dc87497e04fe89c5481e289
SHA256fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5
SHA5126e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
25KB
MD575a9b4172eac01d9648c6d2133af952f
SHA163c7e1af762d2b584e9cc841e8b0100f2a482b81
SHA25618f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736
SHA5125a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB