Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-09-2024 12:58
General
-
Target
efd947775c2bfaf5633f4b00f3035c93_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
efd947775c2bfaf5633f4b00f3035c93
-
SHA1
cef407cc42529ff19d9755c113c15fea7fb2c8c2
-
SHA256
c5b3d45cf71bfd6e89a73ea63c7afd688c327595456df2d1894c336006261ece
-
SHA512
00aa40aafc047ab32d91ba504314548d6dd1aad286cc4d5f6aa447442df51b740e6c299c082dec75997d3d25423fc28df0ce3a8012bf280dc9d7a6fc428a62bc
-
SSDEEP
24576:1VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:1V8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\efd947775c2bfaf5633f4b00f3035c93_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\SX2r5Udg\sethc.exeC:\Users\Admin\AppData\Local\SX2r5Udg\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\BDo7\psr.exeC:\Users\Admin\AppData\Local\BDo7\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\OC7\calc.exeC:\Users\Admin\AppData\Local\OC7\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5ee93b93e9703584310c67cf5f5c9cb34
SHA18598176dc40a057005e89b2adcb377db40310108
SHA256354c47d8d4d27167727bb35dc8f8debc8ba2fc62a73a1ac3a2ced3b11254d2e2
SHA512c96aa38ac3805eb4db0871bfd1da3c45ede5d07f3d2a093a08a7eb39c3e1802df7f533fffa23999b06d88c5acd9ba8d98142f34ac5b240bc89276ea21bcdb418
-
Filesize
1.2MB
MD52c6c043fa965f28284069d2615313ac3
SHA1ac1517f5adb85fbebb6fc07a68a09c404aa8af1d
SHA256d84ffa00a68aa94c1483ae40bd32177111edfb3add8ec337f3c59cdba70c3c78
SHA5126c1185482308650ae090b75349a2d5081fcf284458011984dac8008932c967c936d783250c5b9e779501b98c65d2ad50e410642153f3f70656a8a59800075d56
-
Filesize
1.2MB
MD5fdfee3297e4e0fa23aaaf50459e32cee
SHA1c651275c74a1b64ce37a592db7ed871bca2ff876
SHA2569761f9a71a19d03c445c1f3e7bd173ff3ecfa07753b2430ce051504ccc9d111e
SHA512e59c6b05907e0c570bd0affe939a7d819109638f4bc31d66e3bf0c0443dc45be70b9074d2d3cd5babba0b22f26be722995f7f5a81ca58b4be4c83632a5611088
-
Filesize
1KB
MD588c523814a6e03561037c1a94f7e60e2
SHA177c4197cf38e6e0b45115158fbd18349ea3777f6
SHA256c535f9e2769a5dd9a31800b6e8611c3e0bcf11639d7f2eb84f9fa21d502d1290
SHA512d2e9ccf9571b3845d4cdcd2a6ea8b1f39e6a0fc991151a743ad6c72bf369b4b64d959bb3fa9219eec06001d3c70f73a936de51cf4a009a6f468e2e440ea9c7f1
-
Filesize
715KB
MD5a80527109d75cba125d940b007eea151
SHA1facf32a9ede6abfaa09368bfdfcfec8554107272
SHA25668910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495
SHA51277b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB