Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-09-2024 04:36
General
-
Target
ef144112ab3bd4e5fede0a35175b0865_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ef144112ab3bd4e5fede0a35175b0865
-
SHA1
ea9e920ef55c48d710b9dbd593ba87e1da2f1b35
-
SHA256
a63b33397161f4ae306b3304283359d24e52c75aef053ef690794cc664069c91
-
SHA512
15f45026594769fddeed6ff1f60f15b27cab2492bd12d4d5d910abdab1802e281540823bcde73c0eab38ecd5ab8bc38054b3d7da6db3bb71a4c1b8fd0d236ee1
-
SSDEEP
24576:2uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:29cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ef144112ab3bd4e5fede0a35175b0865_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\EHRZ\spinstall.exeC:\Users\Admin\AppData\Local\EHRZ\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\hK3Lqn\DWWIN.EXEC:\Users\Admin\AppData\Local\hK3Lqn\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\Ozb2E\p2phost.exeC:\Users\Admin\AppData\Local\Ozb2E\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD583098da2418300b548dd9287d8ee2ea0
SHA1526d19bd60085fbe6da703959e812e925dd4c887
SHA256ed76fde7931ff8995fb4eaa26088a13c7e562d3a42a6257070e0c0b7bf8d87b0
SHA512ca453c2b5074c1debadc9bc9d980ca95f78fae4804c3e5999653548b03c6df5b025644dc325e17f21583249dc44b4cb1842736cc81f55f818c89f74facb48a56
-
Filesize
1.2MB
MD50b16ca29b913074da7c99295d12284ba
SHA14e6f9a30307e40098418c0ae7703fd3c99d14a3d
SHA256f062bab1638677b48112a3aabe6c9ceb589e87dd2e5d12e441f95b7f0af2aa42
SHA51250c86e2261ff0da66d18f387232601b449f73e0079015abad756247f4bc60a0b1ce9c5888a5e113b85b97ca8014fd92e6fbb2219bcb4f5ca2c22baba021bbb17
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
1.2MB
MD56ac16ea4db83d7050f8bf978faed166e
SHA1aca910a41128e5acdba0ca1d36aadda26ba10ad4
SHA2568ae4962fe0f66b18c383fbbb0a382128e6e7d055a53d8b12ff544ef0df89218b
SHA5121ae0ebacb26fcffff57cab79c431eef3fea3c00fdf84a0915e3425dc98e8835a264854c66b3cd11e95ca6d4ad9c659c32d3081ff3a08a8c8a0de8e28d4f757ed
-
Filesize
1KB
MD58f030f88435f131667683acebc6ba036
SHA1b6d78c83a2395f68013528d05ec19c3514b7a7da
SHA25666be5515f86e2c908ed6d28ffb134f79f0af29c033fa4236b3e2b45b40bf74e6
SHA512b91b155f1f2ccb22458613784f13ef0190b3381c2651ab65d070890800de8056036daf31eaafbd475969f0c8aa9cef25e9560a059830ce89bbf910acf96564aa
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB