Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 19:20
General
-
Target
f2f48dd5ca9402eba590e53b11d21a44_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f2f48dd5ca9402eba590e53b11d21a44
-
SHA1
cf4bc280cd7180d4fbb2dd42a6bc55b7d5ff7bd3
-
SHA256
67a2f9c4d270e4a3a0d138c9942ffefcc2880639439886a18ba9de001a15d808
-
SHA512
9c6ed03e708ee060e54b07b0ccf475169701a3858866639e02774a4172cfc1b9a5610b668acc9cd36f88cebf8d1827f07e5f55a8945344e09b3bb9b9be3a4503
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f2f48dd5ca9402eba590e53b11d21a44_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\Fzx\mmc.exeC:\Users\Admin\AppData\Local\Fzx\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\4c2mfuv\PresentationSettings.exeC:\Users\Admin\AppData\Local\4c2mfuv\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\Irf4ONKKD\msdtc.exeC:\Users\Admin\AppData\Local\Irf4ONKKD\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5049e382641475257dece1aadbd8bb662
SHA18f1a4488e312194b10ea7e4557abcfa80c576132
SHA25651168f350f5a87538f123e7e8ceb4be9d4ba20302ebf007b0329c8945ab5a7ee
SHA512b7c7a12565f7bb9b301679077c79458648f18210f1facb753a8f28eca113811b8c97cd96fc4d81a53bcaedff3760a75ccb5cb8c0b9b2139c6d7cd50de6d0cfa1
-
Filesize
1.2MB
MD57352bae716472148d22a90ede44f9df2
SHA1f8c0d00c460813eec50d6d562f60fc8885b563fd
SHA256e5fc7437e12cc9f8398282a7faad420e565c8ec436c052a6ed062ff93315d798
SHA5120c0a67e57418faf555fcd392b7cc261c852906650ed32eb437f8da379e644018d3557005417313f71a1bc5531be256915f1c195d61c55820b48da54e46b82582
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
1.2MB
MD54282e29f3a352ba73963d3695300bd46
SHA15396ed62ad8018f902305dfe1509226072c49946
SHA256436ab40434e002a2e92f50e09f53932af36351d890029afec68d1799178f647d
SHA51276975d9462d1f76b6b133fa87af2ec265e3c55cb8891fe221ef1faba93d79591075689ae606b2f5ef0db23aecd31bae323f7c5f54bc0d34fc6ff0a0ddae39ae1
-
Filesize
1KB
MD5d341619bc1f1cde28c45b8e2ddeeb31b
SHA1f0ceb198e36cf9d7f1bc4495e3c981e3aae855be
SHA256e038f0b1c1b0dcd29838d0742bb2369a445be0d54231fa96e07e83a32aeff3cd
SHA512a7c52cf79b2091d93bdfe23b97a699b08f95fb182b971a80920a18f199ef866156e307e3e719bceb525565651994e2c109aecc6741782e321b281887533bbb84
-
Filesize
172KB
MD5a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB