Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2024, 05:28 UTC

General

  • Target

    65a62742a787e492b028d52bdb05e703_JaffaCakes118.dll

  • Size

    1.1MB

  • MD5

    65a62742a787e492b028d52bdb05e703

  • SHA1

    f2b8cf85e293861d8cb1cd943909c96e528781e6

  • SHA256

    60bd90f888794eb99bba351ecab0e7c63e74bc5a05ffa87404e0f60912fbf384

  • SHA512

    e3bc49d29f577273ca331cd1f4325de3edda00bef6fe0a999534b7ddda3d548a683bdb2a4f5e8a5ab4ceb13520a7183d5b03f04bf775206896d7d74bceb5504c

  • SSDEEP

    12288:ydMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0Tkr:EMIJxSDX3bqjhcfHk7MzH6zQr

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 10 IoCs

    Detects Dridex x64 core DLL in memory.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\65a62742a787e492b028d52bdb05e703_JaffaCakes118.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2080
  • C:\Windows\system32\DWWIN.EXE
    C:\Windows\system32\DWWIN.EXE
    1⤵
      PID:2788
    • C:\Users\Admin\AppData\Local\ST2nn7d5z\DWWIN.EXE
      C:\Users\Admin\AppData\Local\ST2nn7d5z\DWWIN.EXE
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      PID:1500
    • C:\Windows\system32\msconfig.exe
      C:\Windows\system32\msconfig.exe
      1⤵
        PID:1092
      • C:\Users\Admin\AppData\Local\KNwM1HH\msconfig.exe
        C:\Users\Admin\AppData\Local\KNwM1HH\msconfig.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:1048
      • C:\Windows\system32\ComputerDefaults.exe
        C:\Windows\system32\ComputerDefaults.exe
        1⤵
          PID:2432
        • C:\Users\Admin\AppData\Local\daXm\ComputerDefaults.exe
          C:\Users\Admin\AppData\Local\daXm\ComputerDefaults.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:796

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\KNwM1HH\MFC42u.dll

          Filesize

          1.1MB

          MD5

          567f73f77004e87bf9fd01f9b70fc4ac

          SHA1

          59a1868537eca9d34505fd4a2c8c1c2189b80828

          SHA256

          9a2c9cc3911200918bf7ea26e5fc5506df5ff3ccd45d6dc21b204e01a6d2e247

          SHA512

          348d5ac65aefa423056819712199461474ffff4b4a2f97d1ea9b7f114d69fd3d69d1ae731bb982b1200bccb87169ad400ecb8c79cca44e7f21048e92dd434cb4

        • C:\Users\Admin\AppData\Local\ST2nn7d5z\DWWIN.EXE

          Filesize

          149KB

          MD5

          25247e3c4e7a7a73baeea6c0008952b1

          SHA1

          8087adb7a71a696139ddc5c5abc1a84f817ab688

          SHA256

          c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050

          SHA512

          bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b

        • C:\Users\Admin\AppData\Local\ST2nn7d5z\wer.dll

          Filesize

          1.1MB

          MD5

          ae35de056c5fe7121ae8c0fbbe6e82c0

          SHA1

          c582682acfafe55b445f10ecc12c02a5e934b7f1

          SHA256

          d5477413c9e29f9837ebc995170fcc3c47a52b09ee34a3ecf3975f4ece6243dd

          SHA512

          47c9fd4f184da24cbc414e01e8c80beee8c78010d844b4457aa31c81720b94f5b016ec9efcd30301e974b5a78d7228c635dcf8f157170d351db1b1872796d76e

        • C:\Users\Admin\AppData\Local\daXm\appwiz.cpl

          Filesize

          1.1MB

          MD5

          ef8a3dcfbbf6b4f06aa4c803972984cf

          SHA1

          2aab3a14690221c22b140d4b3a5eecd58f0ea241

          SHA256

          f9df512e6c218103b754fb64e4eb5fe1cd69062e6b9cde52d962b20d3c6e6d77

          SHA512

          d886dc8393d96108b3d16f4c30595eb427c73b1dcdce074fb4329750fe551c461b01f1358104dc5a0663188ffc57a771391400342abf8aa05c4ee4eba39919fb

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ykefwsdudlbqds.lnk

          Filesize

          1KB

          MD5

          134fb1231475c0de461349207dd3eecc

          SHA1

          40488c0841686bd819d9ea5dadfb689c37410c52

          SHA256

          6a3f19dd53a6105357ae5d54deeabfa5475ae2c2b0b2f6572600443d840601f5

          SHA512

          bc8490fa50cdf30ea99ab7d7a8b52c92242042666c2d4c33a7295f3fd4a5bd0d2cccd80abed360e796ec763ce0354f45eac55298242b96cf42b40aa94e7f6e79

        • \Users\Admin\AppData\Local\KNwM1HH\msconfig.exe

          Filesize

          293KB

          MD5

          e19d102baf266f34592f7c742fbfa886

          SHA1

          c9c9c45b7e97bb7a180064d0a1962429f015686d

          SHA256

          f3c8bb430f9c33e6caf06aaebde17b7fddcc55e8bb36cec2b9379038f1fca0b1

          SHA512

          1b9f1880dd3c26ae790b8eead641e73264f90dc7aa2645acc530aad20ad9d247db613e1725282c85bca98c4428ac255752a4f5c9b2a97f90908b7fe4167bb283

        • \Users\Admin\AppData\Local\daXm\ComputerDefaults.exe

          Filesize

          36KB

          MD5

          86bd981f55341273753ac42ea200a81e

          SHA1

          14fe410efc9aeb0a905b984ac27719ff0dd10ea7

          SHA256

          40b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3

          SHA512

          49bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143

        • memory/796-113-0x0000000140000000-0x0000000140113000-memory.dmp

          Filesize

          1.1MB

        • memory/796-108-0x0000000000190000-0x0000000000197000-memory.dmp

          Filesize

          28KB

        • memory/1048-96-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/1048-93-0x0000000000090000-0x0000000000097000-memory.dmp

          Filesize

          28KB

        • memory/1048-91-0x0000000140000000-0x0000000140119000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-31-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-15-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-20-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-19-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-3-0x0000000076D66000-0x0000000076D67000-memory.dmp

          Filesize

          4KB

        • memory/1216-58-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-56-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-47-0x0000000077100000-0x0000000077102000-memory.dmp

          Filesize

          8KB

        • memory/1216-46-0x00000000770D0000-0x00000000770D2000-memory.dmp

          Filesize

          8KB

        • memory/1216-45-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-44-0x0000000002550000-0x0000000002557000-memory.dmp

          Filesize

          28KB

        • memory/1216-36-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-35-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-34-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-33-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-32-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-6-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-30-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-29-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-28-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-18-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-17-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-16-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-21-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-14-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-13-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-12-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-10-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-9-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-8-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-66-0x0000000076D66000-0x0000000076D67000-memory.dmp

          Filesize

          4KB

        • memory/1216-22-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-23-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-4-0x0000000002540000-0x0000000002541000-memory.dmp

          Filesize

          4KB

        • memory/1216-7-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-11-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-24-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-25-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-26-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1216-27-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/1500-79-0x0000000140000000-0x0000000140113000-memory.dmp

          Filesize

          1.1MB

        • memory/1500-74-0x0000000000280000-0x0000000000287000-memory.dmp

          Filesize

          28KB

        • memory/1500-75-0x0000000140000000-0x0000000140113000-memory.dmp

          Filesize

          1.1MB

        • memory/2080-0-0x0000000000120000-0x0000000000127000-memory.dmp

          Filesize

          28KB

        • memory/2080-65-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        • memory/2080-1-0x0000000140000000-0x0000000140112000-memory.dmp

          Filesize

          1.1MB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.