Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/09/2024, 12:55
General
-
Target
e92a56600266f295094dfbf8f2dce8d3_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
e92a56600266f295094dfbf8f2dce8d3
-
SHA1
52db6d1d6db1e21c1cc8a90b275522eed96e04e2
-
SHA256
526ebbf20321313197a89bbac67ecc6b3289419dfc06b67031c9d838a355e1ff
-
SHA512
5d24771e4232982f1cfb60393826f18c5934840910dafb07cb6e1de8a6932681bd5636ef60e3f413ad2c8b57b451982d59f75dc988693fd757ce12594025990f
-
SSDEEP
24576:OuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:u9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e92a56600266f295094dfbf8f2dce8d3_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\ezTYR2dMh\rstrui.exeC:\Users\Admin\AppData\Local\ezTYR2dMh\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\qlXB\PresentationSettings.exeC:\Users\Admin\AppData\Local\qlXB\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\W4d\wusa.exeC:\Users\Admin\AppData\Local\W4d\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5aa1b4ef70eb8693449a59850fd6eec7a
SHA1bec0e50f89f7fe6872cadbb0a7cccef3c0c66848
SHA256a5df76b1afddea35cb66cb0001f42a12517a27db45cca52c4358de7b73e1deca
SHA512afeaf164df195889a2778d0bb666ae707919e74b55c0f8f1331aa232005664e954db52dc9e7da94d100132926d9ef6a99e7a51dba19c315ec2b05ce440d04dc8
-
Filesize
1.4MB
MD5a50b444f7f8e6a7a8fd47df245950c8e
SHA168403dcc90c30b4969d30ecd81f6105f78530421
SHA25619942ba0d5090b86dd30bfb4b6c878873bea491a924617dd042c40e4b00ff986
SHA5129584944b28ac4a4cf7564a5a2287a5d6760ed143646cba5ff9a7afbf683321a3caef1e23550e45916a80e737405e9d101448fda533735c145fdd73f65ff734d1
-
Filesize
1.4MB
MD5b08b1e9fcd60154ce26e76d54f766952
SHA16e57757563a9d3559f1f9a4006786ecbcd402aa1
SHA2562755231ed97dbcbd5dc30d8d2dbc1613b54de1e8c8692ac994f8d92cd30be802
SHA512df1992400dc124f35ff6f930694e265ad4af01505f69fd21d758c15ce50dc5db9a234e9a1a9bdd0710063b712696fd2f294ba01243a7004aa54c2c89518bd07d
-
Filesize
1007B
MD55d37ae3d8869e43b1c6974414714af04
SHA1647d072f582d2cb4d971ced8ca31392ba52baf2c
SHA25608e9e0bf8810426db9a6f9e1c635698725b002384c83fcfc7dfc9d2b479fb2f2
SHA51276cebb2010d821b99cd4f80c87a4199cf927114d07bf53e42527c9582d43182ae794d6ac642b0c1ab94e0aeff9d4b88e8274838651264c33b570b4cf11a566a6
-
Filesize
300KB
MD5c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
172KB
MD5a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB