Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-10-2024 19:51
General
-
Target
49b478cc38b76090a5dcf3bf2bf85860_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
49b478cc38b76090a5dcf3bf2bf85860
-
SHA1
17eac34e5fa4b82d401a47c5f5763e918693cac3
-
SHA256
85a83765c561ea8375b492b286a66a6541427217967cd399d2e4e4230141e4e7
-
SHA512
6f37c08e374b6b07a7c45a1521b05d2841864cf66d04044c1db9e6c828cdd877adbd6df0602df8db6df86740c28d72a27ed077c916333e2d08cb3129bae57958
-
SSDEEP
12288:pVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:IfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\49b478cc38b76090a5dcf3bf2bf85860_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\StikyNot.exeC:\Windows\system32\StikyNot.exe1⤵
-
C:\Users\Admin\AppData\Local\JEsHuWzbp\StikyNot.exeC:\Users\Admin\AppData\Local\JEsHuWzbp\StikyNot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Users\Admin\AppData\Local\N2riyB\fvenotify.exeC:\Users\Admin\AppData\Local\N2riyB\fvenotify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\dXCeY\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\dXCeY\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5be11a59197cde99bc3c98c4853103f99
SHA10c79c299201bec3efdbf847944136398cf5c582d
SHA256a30c3fb2f2ffbe64b4a64df65ad27ab2a25e0eda4554c1d9ed5a96fce4c8009b
SHA512901dc8ceea222c74101e20367e8b0586c477ff936819966c3800d715145d5ed4c8c02195adad0c8fd85057384da2c5ff9e98fa50b618a709b79d23eeda3c5705
-
Filesize
1.2MB
MD5225729b672a43fa7e54d7c18861161a0
SHA149df6e0164917379bc8c547192aed48032b0a599
SHA256943f4001ca0f566e8807b9e34b37fb5d3fa753ea40515451f73bb750658c023f
SHA512b3d5143981da6b6daa518dcd2bbf14ccd4d5ab352b9c647e5232dac3763d86477939b87654ffdb0abcabddee3663aff39db154e4aa21dc0a33e08bb9e121ff46
-
Filesize
1.2MB
MD558810058c2d03427b5a498b1544f5971
SHA1501e68d79e2af76efea26d2e480b08a6064250bc
SHA256b84e51c73adb51d811155168318f30164dfc2772cccdbe9395d645ff571d7c85
SHA5120c3ffa729a18a027cb0f0f658e4274b1c5b4a41ba7002f1a1fe122334c2366ab3c4fadb8f24957f1b25afcb56d85e1b83932eccfd3fcd71ecc9de0f0263f7cd6
-
Filesize
979B
MD5c1a6c841ddcda302adb543167610c718
SHA1d7a631696832c8fa6468d80a3542530df8c7cfb6
SHA256fb09f4aea3feb127202d1e7889cc19932a2fdc096be7880b809efebcc35bda4e
SHA51201a224d3b6b2bb8939cb3eac55a021204ba96e772778d69c4bbb061e84ed5ca272bb69d3bf93303bb998489f15cb60ec9023de7b3e3eb27f0a4d4ed586ea989b
-
Filesize
417KB
MD5b22cb67919ebad88b0e8bb9cda446010
SHA1423a794d26d96d9f812d76d75fa89bffdc07d468
SHA2562f744feac48ede7d6b6d2727f7ddfa80b26d9e3b0009741b00992b19ad85e128
SHA512f40aad2a381b766aae0a353fae3ab759d5c536b2d00d135527bba37b601d2f24323f079bd09600355d79404d574ac59201d415ef64c1568877ad0ce0da2dd1d5
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB