Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-10-2024 05:42
General
-
Target
049096c3169d8d3df37231056cc1ddc5_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
049096c3169d8d3df37231056cc1ddc5
-
SHA1
a11b8d2b9144cfd9d15bb696ac117ab725484e86
-
SHA256
221471dd6a3b6edc506fd5e9e0d32c3bd5fb95f631ef02bb2dfa56ff04a9e248
-
SHA512
1c63495a42cf214e9a475877e94fe51994efa724c1f189209e7ed4503d3e52da46dcf34d4bbea055534db6b1fee9f5c8f1ebe42da60d4c2fa375688ec83fa9a2
-
SSDEEP
12288:cdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:uMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\049096c3169d8d3df37231056cc1ddc5_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\diDM\unregmp2.exeC:\Users\Admin\AppData\Local\diDM\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\icardagt.exeC:\Windows\system32\icardagt.exe1⤵
-
C:\Users\Admin\AppData\Local\7cdPU\icardagt.exeC:\Users\Admin\AppData\Local\7cdPU\icardagt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dvdupgrd.exeC:\Windows\system32\dvdupgrd.exe1⤵
-
C:\Users\Admin\AppData\Local\BGQH1ion8\dvdupgrd.exeC:\Users\Admin\AppData\Local\BGQH1ion8\dvdupgrd.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5fd6b639b7bf1771bf1c2217fbf423176
SHA14461d0c8f2d1ab2329cb8d51dde204896c402c31
SHA2569fbe56e97b7fa6331c8cb6ad940d85fb1b69dc444894a7b6b5e7a315277c701d
SHA5120d7e935a2ec9178e95d7ba3ca7ad93f88371f75090fe0d9737a94e6b6190a3ba2621614963657442ebf9c52fe6520fa161687921c52d5ef344869072b51d177b
-
Filesize
1.3MB
MD59a327701c12023dad60b22bd79a84ec4
SHA1793969b7190c34acc38b695d4e6ec92039093393
SHA25678e0fd305dd7df4444fd0796d7101caa46755b90e253dade18477cbfb80d4193
SHA51205179ef05fb0c55d60149b4a302a337213fa8140055a59808a5af5998959c7d398fc7e8f3234da920c9b1eca2556e944c4cf50dc7f2a57f0038e04fb02de95d4
-
Filesize
1.3MB
MD5206fc377d7d25be7220b18dcaeebb261
SHA1f8eb8739a9e810e68e2f3d6a79017866236409aa
SHA256910b9240ffe0bb73cb7fcee9adf66c890ff0abd29aefd0f1d16d38ecf43bba51
SHA51214a64e45b81157d7c58b88b2e0d8c38aac40cc215fbb2eb69bd21a5829f4c6e32334a9770743cb0d76bea2d87689a29d957e30cf657bd0d5120a2b1b0f6a4370
-
Filesize
1017B
MD5a8797d6b0ae7bb81b5bc22ce384fe321
SHA19428a492ca416a93c0dca19d88a15739ca29f5d5
SHA2569c8bff88d014c50fc7ccc515b4fc5d5139a2eb0b0c7cea189f02d00de334e144
SHA512af0d8813212e82840acf8aab04fe8c724e05989f9d5fba0f22d2bd3d240193f1636339d69c032bd028d5528bfaccd1d56c3df8b0d885a751c92f3aac6e4e831e
-
Filesize
1.3MB
MD52fe97a3052e847190a9775431292a3a3
SHA143edc451ac97365600391fa4af15476a30423ff6
SHA256473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
SHA51293ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
-
Filesize
25KB
MD575a9b4172eac01d9648c6d2133af952f
SHA163c7e1af762d2b584e9cc841e8b0100f2a482b81
SHA25618f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736
SHA5125a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB