Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28-09-2024 06:01
General
-
Target
fba5b46899374a9f66e4a2dcfa9cb2fc_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
fba5b46899374a9f66e4a2dcfa9cb2fc
-
SHA1
81fb319d0b6337c09cc8a4503da5c27b4e5d31fa
-
SHA256
383d9d2d0d8121f36b0c1274c3f168237eda7d4dc593a555871f67474c48ba6d
-
SHA512
e854de2c6b0af464e43c04d7d2f1b3a8d9aacf84409dc52bfa6fb7c6130c26c6197ee466dcfb88402c3d1fd22bb65093b9369f130e892610bf51007e8104d022
-
SSDEEP
24576:7yTonNVlKTt/Q5ECvVP7hpJMvjtKpvPf9+m6kLRqgSyI:7yWRKTt/QlPVp3h9
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fba5b46899374a9f66e4a2dcfa9cb2fc_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\dE3XZ\irftp.exeC:\Users\Admin\AppData\Local\dE3XZ\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\icardagt.exeC:\Windows\system32\icardagt.exe1⤵
-
C:\Users\Admin\AppData\Local\wh7ki7\icardagt.exeC:\Users\Admin\AppData\Local\wh7ki7\icardagt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\8HXoibNF\SoundRecorder.exeC:\Users\Admin\AppData\Local\8HXoibNF\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5068b22665684d52eaf0a035a7fc65dbd
SHA1b8bd56827ce046db33460b87ad5862ce773895a8
SHA25602aa3b58dc75d0380303575487378a2eda4ee2adc8bfb62cf7ea24121e29879f
SHA512f86fbca96388400d801d4cf5878fdb6abc08ac9926d74b759a0fe6e45669bdc3bf5508f527d66c311ed177c1b5205f3506244626cb64b112a4d2287e54689a47
-
Filesize
1.2MB
MD5ac8d16a866cbc0aa67a347a6a5161fc9
SHA11419205e4f2d09652603db95abc413953000eade
SHA2569f121b567957ecef49f4f45aca89a63d96e2d93f2b840035abf5c6e9e1037cc6
SHA51291e07e7353749536ca613885bdddfdcc674a7583b83b2747ef8879d52c82a628a98022138da321fa7b690f9c2ce08c352c9cfa5cb0a1fb6a8f542fe6c8f4c736
-
Filesize
1.2MB
MD52d8eada0b10454d8e7cff764d53b6e1b
SHA1b8ff3c7849628283517248445dee476d796a9495
SHA2563e700225eacb5107b66ed43fae97a647d572297b9f7e78adf6f75934ddabcd0d
SHA51292c937f8bff5b12e3640e30b7654a4cde1b8fd31084882f0a5efe035d3e5d9bb064ca714c00c1ce6f3cdad6f27bd302e6e14a29bfb43bc2148096e927a99b827
-
Filesize
936B
MD5706059a00a2fe6361be59e4325ae9d9c
SHA1c151e93f564834d84b8b14e39f4ef0c6006286e3
SHA2562a1965c7a9d62de79f5aff146cbfb980e544dfce47f8de8945651f6a7960d034
SHA512700e4340854a1b9b6126a1e74cf7036464943d504ce1cebd5f20f5ec2a4782aa590978351fb4caa6d4e500163b7654541790352d63137b457aff8f4f2a6c5a97
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
1.3MB
MD52fe97a3052e847190a9775431292a3a3
SHA143edc451ac97365600391fa4af15476a30423ff6
SHA256473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
SHA51293ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB