Analysis
-
max time kernel
152s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 19:42
General
-
Target
ec0fbfbc9d92e4357791f2f1613571eb_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ec0fbfbc9d92e4357791f2f1613571eb
-
SHA1
ac4c84d2178402a2e6fb29b3bdb6178495161f11
-
SHA256
a638b49731c356434985d9ef68e10b6def07bf5b398059ea17c2cf8dd1b9f1cc
-
SHA512
d9d1c1502ae4774d7eeb8ccb3315ef41a40e15c5a7644e8fda521ec94bf6b9315efcc0ed8c289f716fb143d2c2975f76bd29e4963d8c8854fe303c61609a14a7
-
SSDEEP
24576:WuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:W9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec0fbfbc9d92e4357791f2f1613571eb_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\FXBZ4\cmstp.exeC:\Users\Admin\AppData\Local\FXBZ4\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\hV1E\WFS.exeC:\Users\Admin\AppData\Local\hV1E\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Users\Admin\AppData\Local\o4EHs\rdrleakdiag.exeC:\Users\Admin\AppData\Local\o4EHs\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c98e882c55c69984232bed395a98cf92
SHA17b8d3c4f41f963b6018ea4b6d764fb2d2e4472ce
SHA256c00ca015a60ed6bbbed85fa1227fbdabaf46009f1be68a820a0d56f1df704ac4
SHA512782bb4d980743197190e7d2d2ac32e18d056bde36db757328c0739d823254715975e0ea732bac24f849957e6e90fc307b1b50ee014b0e4437ac3ec30ac9f4a88
-
Filesize
1.2MB
MD5f649feae853d22330866bc99aa9d0f52
SHA1f2468c05fb93669b1278ce2de1e3d4ca6a6ecfc9
SHA25629e66e44325d76b3787e04af97b15796021d10876323d5bd36527a449372c208
SHA51283d113b5b1e8334522555ade7bc92e88f925292e80cd03cc27110e91c75daeff643973a6c661d090cd13badb75913c18bb9af497a35b38d28a584dc7644bb7c3
-
Filesize
1.2MB
MD53287e88cdc5333680f2da63d827c9cd3
SHA1a486a8b3da021f43a3d196ac892dd580f419edc2
SHA2562d9990709d12729792517d3418333cde736bb1a4037db11ed1dc1fc3e59af364
SHA51230b3d6d69458f828611b4b7dfa3c38072bf1e25ec119ee91edcbf8850eaedf01d83fe51e0a33a8a2ec143e02eb7251de172978257ecfd05fc5bf4a390d124eee
-
Filesize
1KB
MD5e5ded4673a42e6203a4aa882aeb7df26
SHA105710992a4c22af958c375412331a74cef8a293c
SHA256237a3f0d3ff55daebbe4971045e51b177d211eeae6cb26914332eb87dff334d6
SHA512dfbcf93c4512cecd3c30910586d51312ce5fafc6f7b55b4b19786d7a4cbee598824faa6bce45a346c957362b7ee3646abf72c56d0c0d77f29c6d2ee56013cc72
-
Filesize
90KB
MD574c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
Filesize
951KB
MD5a943d670747778c7597987a4b5b9a679
SHA1c48b760ff9762205386563b93e8884352645ef40
SHA2561a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610
SHA5123d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934
-
Filesize
39KB
MD55e058566af53848541fa23fba4bb5b81
SHA1769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6
SHA256ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409
SHA512352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB