Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-09-2024 18:15

General

  • Target

    ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll

  • Size

    1.2MB

  • MD5

    ff18e8259190c79d60bdb5e0ec552404

  • SHA1

    ffabe6c627e7824f5ff3d10c3716f03a4ae6dea9

  • SHA256

    e65d864ac680a40fcf898cb480e6b6eb2406307973a19b5001edaedefc4b3f7b

  • SHA512

    30efef42d9b3874822388b4c6a8c196d518fe560cd0bb12b23f0af3ad82da90533351e518a661a91d850b968b80d505fc2ada5c9dd10127c04ab3e157b1fac47

  • SSDEEP

    24576:auYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:C9cKrUqZWLAcU

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2096
  • C:\Windows\system32\psr.exe
    C:\Windows\system32\psr.exe
    1⤵
      PID:2792
    • C:\Users\Admin\AppData\Local\iOmmYB\psr.exe
      C:\Users\Admin\AppData\Local\iOmmYB\psr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1900
    • C:\Windows\system32\ComputerDefaults.exe
      C:\Windows\system32\ComputerDefaults.exe
      1⤵
        PID:2672
      • C:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exe
        C:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2192
      • C:\Windows\system32\rrinstaller.exe
        C:\Windows\system32\rrinstaller.exe
        1⤵
          PID:2860
        • C:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exe
          C:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:2856

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exe

          Filesize

          36KB

          MD5

          86bd981f55341273753ac42ea200a81e

          SHA1

          14fe410efc9aeb0a905b984ac27719ff0dd10ea7

          SHA256

          40b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3

          SHA512

          49bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143

        • C:\Users\Admin\AppData\Local\hoGrn5P\appwiz.cpl

          Filesize

          1.2MB

          MD5

          0e8901e6d3c73a919736590e6a252581

          SHA1

          ae016e211e05ed6eaeda3767ed8d01fa477a5e7d

          SHA256

          b6c51115d6e9eb178ad855dfabfed9896623fea804c718cf2298ac4f2d7684c0

          SHA512

          a8d05136febacfffdc7b56b2508e459f49daa7008b363019e781b4f25f4727a8a72f4a1f31bbe380d9972710fcb79a7780e71bb12e97fddce0146bc45418c1ce

        • C:\Users\Admin\AppData\Local\tjMJS7\MFPlat.DLL

          Filesize

          1.2MB

          MD5

          761880a0673efe341bec445a6c6ac548

          SHA1

          4e977e0019e84376d93c21a64e3dcf711e7a4421

          SHA256

          189c669c126ac8e04910d043ce9858257c457b7bb6158ccf57e81ebf2645d3d8

          SHA512

          6f6b734f42db6ebbcdcf4bfd638958e25771b067f9cb2e321b657a75efcfe783106886588cce839c1cdf017802bba4d6af53396bb10c0480c36247c7e9565a5a

        • C:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exe

          Filesize

          54KB

          MD5

          0d3a73b0b30252680b383532f1758649

          SHA1

          9f098d2037e4dd94eca6d04c37b3d4ad8b0cc931

          SHA256

          fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc

          SHA512

          a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yjafzwirjcl.lnk

          Filesize

          1KB

          MD5

          38bd488124b132d0cbe8a997577fc1cf

          SHA1

          b4dc89c195e93c757901643e4e3ab03359faac35

          SHA256

          1d23cb183be90c35e7e79e32179974e2871a7ac4a3ec73a46b4ed75c34a90d0a

          SHA512

          75802ea3e41a373b1f57ffdc523ae252d8482350a5dfcdc670d5f95dd745180d35b8684145d55c8c3247baa0bdd6d3a7662fe5a519e79046983378a6f88198d2

        • \Users\Admin\AppData\Local\iOmmYB\VERSION.dll

          Filesize

          1.2MB

          MD5

          bde577c36ebe4ef6b1f3532eb1bd36e2

          SHA1

          6c3676f6f1ef79053fa465f13e8846c27a963125

          SHA256

          da19a2e6c5baa31c7f9a4aecad10c30704320b0fe4a004901ca1cf35aa78159a

          SHA512

          59f1e554cd98f2af123c28a7fe4d10735e53be0b6cea3fed93829bd9960aa46ba67c3d9e728938d51410b434a09713e6465f958f693dcbc26c5199593d28a84c

        • \Users\Admin\AppData\Local\iOmmYB\psr.exe

          Filesize

          715KB

          MD5

          a80527109d75cba125d940b007eea151

          SHA1

          facf32a9ede6abfaa09368bfdfcfec8554107272

          SHA256

          68910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495

          SHA512

          77b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774

        • memory/1244-27-0x00000000773D1000-0x00000000773D2000-memory.dmp

          Filesize

          4KB

        • memory/1244-47-0x00000000771C6000-0x00000000771C7000-memory.dmp

          Filesize

          4KB

        • memory/1244-12-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-13-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-14-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-26-0x0000000002520000-0x0000000002527000-memory.dmp

          Filesize

          28KB

        • memory/1244-25-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-17-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-16-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-15-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-28-0x0000000077560000-0x0000000077562000-memory.dmp

          Filesize

          8KB

        • memory/1244-4-0x00000000771C6000-0x00000000771C7000-memory.dmp

          Filesize

          4KB

        • memory/1244-37-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-38-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-5-0x0000000002540000-0x0000000002541000-memory.dmp

          Filesize

          4KB

        • memory/1244-7-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-8-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-9-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-11-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1244-10-0x0000000140000000-0x0000000140131000-memory.dmp

          Filesize

          1.2MB

        • memory/1900-55-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/1900-60-0x000007FEF6450000-0x000007FEF6582000-memory.dmp

          Filesize

          1.2MB

        • memory/1900-56-0x000007FEF6450000-0x000007FEF6582000-memory.dmp

          Filesize

          1.2MB

        • memory/2096-46-0x000007FEF6450000-0x000007FEF6581000-memory.dmp

          Filesize

          1.2MB

        • memory/2096-1-0x000007FEF6450000-0x000007FEF6581000-memory.dmp

          Filesize

          1.2MB

        • memory/2096-0-0x00000000001A0000-0x00000000001A7000-memory.dmp

          Filesize

          28KB

        • memory/2192-72-0x0000000000110000-0x0000000000117000-memory.dmp

          Filesize

          28KB

        • memory/2192-78-0x000007FEF6450000-0x000007FEF6582000-memory.dmp

          Filesize

          1.2MB

        • memory/2856-90-0x000007FEF5F80000-0x000007FEF60B3000-memory.dmp

          Filesize

          1.2MB

        • memory/2856-95-0x000007FEF5F80000-0x000007FEF60B3000-memory.dmp

          Filesize

          1.2MB