Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
20-09-2024 13:56
General
-
Target
edbc2bb8ff32ba555d9ecfb4ebe4336d_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
edbc2bb8ff32ba555d9ecfb4ebe4336d
-
SHA1
30fa3d1d4d7f4993667d2717a8fcd8fa27ba9656
-
SHA256
4128d0f84d420bcd7d2b648660b3cae21bcbf088e8a82f225b65acf95de78d98
-
SHA512
0ed34499393e76d87da9c227a755086147720d36e358bbefe8e0167cbeb7927b843202ba35e8d9eb86da25324c89511d8b4891da46fb59e01dc3a1cd660ee28e
-
SSDEEP
24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NHt:m9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\edbc2bb8ff32ba555d9ecfb4ebe4336d_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\jQiXowI\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\jQiXowI\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\Z4Xs\WFS.exeC:\Users\Admin\AppData\Local\Z4Xs\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\EaFZ0OR\rstrui.exeC:\Users\Admin\AppData\Local\EaFZ0OR\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD521235cdc9749939488ae4123014e99df
SHA16a991ffcab96ac13d884dd817b2ce0865f6d2856
SHA256873431987dc7b5a39927c89c586a2a6a2ef5d5827ee2a0e27d9b818580931f69
SHA512636c8553b8230245bdc5697299496e9f2404a99eb149894b337640cdf2b10dc93b893aa8f8b7985f31a638c4ca046b269cb4e62a505ffb05bbf18758093912a0
-
Filesize
951KB
MD5a943d670747778c7597987a4b5b9a679
SHA1c48b760ff9762205386563b93e8884352645ef40
SHA2561a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610
SHA5123d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934
-
Filesize
1.2MB
MD53f8c300ea8c49876a76d74d68740e6d3
SHA13737f7981266afcc6d2160e1459277ed64266084
SHA256711a1d74c898fecf82dd55d5015e4794b6688c5ce425d53d182ebdfec184b79f
SHA512a81695feab235b40945486944c194ba1548b509b7726c37367b198cf04d7638d0a3803b768687e4215fd432c247462f3f3b0058ee14ba242282fe21b9493eb30
-
Filesize
1024B
MD50842084b5e4f4101210cc1201bdcec5a
SHA1466275a4e023e7356596cf2eac2070ebe830ba92
SHA2566d7449e6e2b3066c8ba319178a818dba8ac5d99ad7f592c83717b6ab95d75e69
SHA512d0462e94678024f2705e85ef2dcbdf8c2deb1fc108855e55e70baabe05bf9c0ddacd2329bac18c8986050864e5a8b2bdf415138acd0d3fad6270732f38221959
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
1.2MB
MD5d01baba2d9e0904d1956fc16b797206b
SHA1feb04e7fb4908a5408edc51ccad9aee5bd82b4e6
SHA256380d0d2912419ab308eba98327231694e6277884fc18187fd9ae0a20521c21df
SHA51204a3b6e39878a601fc72a8313d4ae88483e34aa298a8271d81a96517e1a9d8b6a3ba6eb3d61c8c6fd122b89b5a5272379fac2604d90259f8e85277591aa6353d
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB