Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-09-2024 19:54
General
-
Target
fd08217e7bf39060422120e0bf0c3c55_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
fd08217e7bf39060422120e0bf0c3c55
-
SHA1
30b0479d71ea93a53e6ba7dc47c5f3cbf226de13
-
SHA256
71589f5444e986a5cb4bd2043518f4209f7afa633c826b3f8471dba7a47a689f
-
SHA512
c0aff810372c653b505c50abd8a21960dc951798102cf726373178f53fe7cf96d33f97baacd0b98e34eee4fa3416243fe0af4f3ef9f1ff5b3ba6eb194fe98208
-
SSDEEP
24576:suYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:E9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd08217e7bf39060422120e0bf0c3c55_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\PZU04Qt5u\WFS.exeC:\Users\Admin\AppData\Local\PZU04Qt5u\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\C9jMOR4c\SndVol.exeC:\Users\Admin\AppData\Local\C9jMOR4c\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\Unot\xpsrchvw.exeC:\Users\Admin\AppData\Local\Unot\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD5c3489639ec8e181044f6c6bfd3d01ac9
SHA1e057c90b675a6da19596b0ac458c25d7440b7869
SHA256a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103
SHA51263b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9
-
Filesize
1.2MB
MD52c3f3b43a5b76e08c55a7ab1823d1c45
SHA1732387467555f4452c68c8ee39c1de035d8c9d40
SHA25638808937dbd20aca8d0798bcf692646b95b34d562600b8eb4e5e915fe30e159d
SHA5121faf8f9c7287866f5ba428da5b53214a3b98216e738d71229959a5e2c3791ee6c43405116bdf062cdc395a6c8cb7f226cbb3e98ecc88c6394f158ae51fc4c28c
-
Filesize
1.2MB
MD52140cd46193d83b093ff67d67e832ebf
SHA146fd0d2f8c7bf6276ec132ff6809fe05419f8ba4
SHA25675a48c2cd8c3ff7c85897d1de8a38e961fa366f47c4c949f387cf7947746b9a5
SHA5124bb8789a0944b5fb2dc76a21039aa2c9add9247ffdce60ab105f7765ab92fa696a0bfbba1c1709000bb87d7ee36bed825826e2b5174114792a7df498ae25847b
-
Filesize
1.2MB
MD56bdb719b0857947788fcb2a4fddecd1f
SHA14554036a95c724523ae1c491bd2a459b0c6ee5be
SHA256eb415e510d69fc81dbbbf165876cf2612480a6657b4e452db4165c9580fbd587
SHA5127a78203f5b6126ac0635961466292903d51fed042ae4c9c0f811fc3ea62e0035f4b1c104a85880a95bf7e38b6c5f9ced42a20b8ef97ef9908e2d64a23de35657
-
Filesize
1KB
MD5e87d2ac1515d360bb98ab5908e8ab305
SHA172619989694f136ff7844cdc69c949a69fca29c0
SHA25695be8ed865c3bf24b4ff0e342fe28c4f9c5daba005b780d5fa00b3f05d8d6db3
SHA51290c271f50fdd57029f757ab2bd973394c7a7a56c6c85f7b9f8d013d2bf274fe704ce6b0a3b159e81483b2528e2cecde6e53d7e89bf541f005d06ce59cabfa38b
-
Filesize
951KB
MD5a943d670747778c7597987a4b5b9a679
SHA1c48b760ff9762205386563b93e8884352645ef40
SHA2561a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610
SHA5123d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB