Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 17:51
General
-
Target
f286092e8fe5d17abc765a52b10751ab_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f286092e8fe5d17abc765a52b10751ab
-
SHA1
b61edfebd10a23144d9a57f18ab23793a03e3acb
-
SHA256
3669fd31aaec1ed1c3de1f93b27b2b662ccc5c02957edca53da6f7a7072488f3
-
SHA512
75c27d2e52dd9cb29770da557d3360229d213871c70ba84dfab092eaabe1a42c1a363b66207a8b1d0d95ba7cf0a541be95cf40f781455df29be75a7a24ecfed2
-
SSDEEP
24576:HVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:HV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f286092e8fe5d17abc765a52b10751ab_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\8swC\SndVol.exeC:\Users\Admin\AppData\Local\8swC\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\ZtHK7E\ddodiag.exeC:\Users\Admin\AppData\Local\ZtHK7E\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\ksZncaQsg\wscript.exeC:\Users\Admin\AppData\Local\ksZncaQsg\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f81e5ea40713cb60c3205945c23203f4
SHA17951d0953ea05dd518438dcb67869cbd14e4d637
SHA256a4d7534ced1b7ddcdb6c71f5766087416d9a448bfc3406e0b41b0610d65fc7df
SHA5128aad220fb6117601a82ce9484c391b132bd79ba4e51d8eff5c51ef1004b1823746319db0e031778157c0bca08a57a756689163f40e54db9d773393e634c95593
-
Filesize
1.2MB
MD57c24c2833b30d4f95a08ed0501bfc450
SHA1a621cbbd3e1110738993aa301504364413461d03
SHA256d2ffb7253ea24d2e1372d8c052faab50cb839baa3e234228f0abbe00b33ce94f
SHA5125c8c4baee55520c3c60aed1a6221bbdd0ed942d093af8a050ce6940165babdaddfda732c5f3959ae3df2da3d7f6f9f4ec849ad73707757b6f7ec6300a12df8fa
-
Filesize
1.2MB
MD5e2e45d875fe0ed856e262f6538c9422e
SHA1c410dfb839b9f5c581f584e898f01c7225853884
SHA256c4b44d8c5be01a04a19010ae3077c3d901375a7e1e92ecc663ac74e245319565
SHA512cd7cfd18851a71f0255cccfb6dd3280abfd017a99fbd1f76f815491de3194e8725c481550a3e09e80ee1c13706ea84d1439bd5410ce2ed85d6e7921b389e6336
-
Filesize
993B
MD5b3504837f2894fcc8b5bb707c42a6582
SHA196453016b184c403cf5091d2a938f6404ed703c1
SHA25688255f2698b3782429dd31ae33dbf61dbee9bd7038f74ff48657dd3dffb9dfb8
SHA5123e4331fd02932f1d552634991a04e7b1002315343164a10c6f0fab934d3e163c70b6cb95ea99328e71f6fc27e38a3c4fa9e98aae5e246c38e5c73f6b7fb83932
-
Filesize
267KB
MD5c3489639ec8e181044f6c6bfd3d01ac9
SHA1e057c90b675a6da19596b0ac458c25d7440b7869
SHA256a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103
SHA51263b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9
-
Filesize
42KB
MD5509f9513ca16ba2f2047f5227a05d1a8
SHA1fe8d63259cb9afa17da7b7b8ede4e75081071b1a
SHA256ddf48c333e45c56c9e3f16e492c023bf138629f4c093b8aaab8ea60310c8c96e
SHA512ad3168767e5eba575ae766e1e2923b1db4571bbeb302d7c58e8023612e33913dcd9e5f4a4c1bc7b1556442a0807117066f17c62b38fe2ae0dfaa3817b7318862
-
Filesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB