Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26-09-2024 12:27
General
-
Target
f85ef19bb03d5ca288b7b6aa1077168c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
f85ef19bb03d5ca288b7b6aa1077168c
-
SHA1
abfb99abb75dbdaa00e7b3827c22817180c3a016
-
SHA256
3a5d69c3a2b52ad6d2eb5c1471ca4e93fbb17cae1bc33972a67c2aedda09581f
-
SHA512
0a4d9fdc3ab4694f6ce9ef3dc5251d1f048a60bdf73ccde4e6e00c6074fa4ba69ead7aaa0c63ebdc83ce00a453c935c8a4b4f1953f709dfcd8d57be10e42e485
-
SSDEEP
24576:QuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:A9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f85ef19bb03d5ca288b7b6aa1077168c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\ckKbokPBY\raserver.exeC:\Users\Admin\AppData\Local\ckKbokPBY\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wisptis.exeC:\Windows\system32\wisptis.exe1⤵
-
C:\Users\Admin\AppData\Local\icw1O\wisptis.exeC:\Users\Admin\AppData\Local\icw1O\wisptis.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\nd2e\spinstall.exeC:\Users\Admin\AppData\Local\nd2e\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55769eab96bf951ec99e0a3218f293764
SHA141f55556f01a72198612e1f68a8e6c2275bb0ef4
SHA2567d5ad8a9a3c9d6a974892bafa81137e0a6a73c1c55156a5aa9dc5188b0e44d2d
SHA5125168a934a218c89176f75f67fad8ac96e78e558d97b35c943a157864e1bc2a41859b09d4521ec72e137b7d9cd3f01b0399195b8dafdbd8ffb036bb8fb54b45d0
-
Filesize
1.2MB
MD509748a4ca9316999fb07abc3f418e27f
SHA1aabb44bc3cc164dedeccd9700c57511907a806e7
SHA256d9b150c61d4d7de266ffad60509f6010abe6bf7305a7fea4d7f7d11c1e52e8d7
SHA512d4b26c7c7200707cb8340724e9133ef9b445458d0ebe7688962834166fe3d8433b14e751f9a6408271fa404b07777df5784d221eab643ff725fe190d2117211e
-
Filesize
1.2MB
MD57513e55f426079b6b52f0552a7803462
SHA1a226c22be48e94d2ebb4bea498f851330df7ad5a
SHA256dcedc57c6491efeca3a4733f843dce09a783b2a98524a9af9b1f94a5be5ce783
SHA512465e1f02f1ea1abf09dc9ee8bd049a5fc83c3ffc8a585bcc6d78355de43c389112c58d064e55122a5513f02aa4029a3b9c8a036e95c90a73740770b9013a1386
-
Filesize
1KB
MD5ffb82126457de128c3acec5a1d403491
SHA19f025a64dc217b0cbcfff7db1e2fe355fbf325e5
SHA256841a651c8a80fc53c57ce7524c65496470abc6a1c6773d8795bbd22f2ab49420
SHA5128500631abe4763d7cf942102f3b578eb130b9f6e44e7d61e8ac9a263e1adc61abab70deb1e02b777378933e69beeefffa557ced1b8dbfa093e4a169ad8514c73
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
396KB
MD502e20372d9d6d28e37ba9704edc90b67
SHA1d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA2563338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB