Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 02:07
General
-
Target
f11240fb900080790ef18fa1e436f88d_JaffaCakes118.exe
-
Size
276KB
-
MD5
f11240fb900080790ef18fa1e436f88d
-
SHA1
f589e6289ea5216764825d1da2f54b4e3a06bd2c
-
SHA256
b255a8d572e4e44f5ab8ea2bf71da47a963cfd5ba73b5c386ad55c6745cc0544
-
SHA512
69b0cf188594a6eb9f5f7453e36d4c8cee6fdce1dbb210b53680bd5df56af9e4ecd6e02b995d543f6f42a8da41b9d1b2a794704f388198d42523504c27f0a08e
-
SSDEEP
6144:Sg0MsHKuduGhbTDrV+GAfaQhgXJKrAvvC7je2sXfJ:/7wv8YbTt+GAfTeXJKrGa7aL
Malware Config
Extracted
dridex
12333
146.164.126.197:443
193.90.12.122:3098
157.245.103.132:14043
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f11240fb900080790ef18fa1e436f88d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f11240fb900080790ef18fa1e436f88d_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
276KB
-
Filesize
276KB
-
Filesize
276KB