Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 23:14
General
-
Target
d418d7b35f768c06a4d7efd05dc26667_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
d418d7b35f768c06a4d7efd05dc26667
-
SHA1
8ead726ea63ef0c35da8b7676aa9b01b5e9160a9
-
SHA256
dc16ed16999422e0b18228f6624b460456b6b7ea294cb0ef42d0056dd34d06e4
-
SHA512
cc72a2ba2c2691fd2ebf87d79fd1e5a842cab587bc783295310aff940c12ccf13c3549490a5989d58d0bfb98b5bab29791366f7fd5f00964c9897577500e223b
-
SSDEEP
12288:MdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:+MIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d418d7b35f768c06a4d7efd05dc26667_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\XN04qZws\cmstp.exeC:\Users\Admin\AppData\Local\XN04qZws\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\kSbF\sdclt.exeC:\Users\Admin\AppData\Local\kSbF\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\GJCRQ\cttune.exeC:\Users\Admin\AppData\Local\GJCRQ\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5c561fb23565252cb7dbdfe182edc49c4
SHA15581c3e06025ec1bfc7b1c44d3cf9aa36ae2bd8b
SHA25689858f7bcef25c4f3c1a724fa14e049ce577cf8363b5f85a542fb6e517625769
SHA5120cb6218e0fce5ed7cf8c56c6dbc476a62eca4c4f6086d0871914cdbba7545b5e0e2e70c45d81750b3e71bd01236872692489932259cced261a5e159fd78a1b1b
-
Filesize
1.0MB
MD50be9f677287649ffc8dc62d660ce4d45
SHA13fa8e5dba49343e603f7a28e8b9a76dc088c3de9
SHA256e40e8b7941b642b448ed604183abd1d772eb94ab8cddc827ec837aad12ef75d1
SHA51270d55552c254bbc412ed474831ce21919a548e1b4c5c2ebf78f4b888efe18c87dc6c622e604e915458718043c60c360be3dff7a59e7421f86ffd3a24081aab23
-
Filesize
1.0MB
MD5be2f9281b31aad368b3ba9bfdc66cc4e
SHA18ec1637886e37d436519df578b90ae1fb0e6377d
SHA2565594f3290fbddde622bc9f750af1da08a9e9624f7e9c34a2250718e12b9157d4
SHA512986c96ebdc4821886b50414c1c5636f5a3c6c79c42e06fcddfb2dad653ca391d07e97e21e18da79cabb5403ea0acaa9e5c2de0efc6b7f3b8f10341e2a3d4e148
-
Filesize
1KB
MD5c1ac859ee23e497727c8c20d833c7816
SHA16190b63fa1c06f058e29f1e704c8f09ab687e20f
SHA2564af7ec81dc3b560a21fc3eeeb4a39998c08b405aa4d80fbb49c86f8bbc868652
SHA5120e44b2a80ac5538271f6fe7b50769d1038ae9443da0c336686f59f1d12921efdf4d8622fbe0257f0191cc4695365536f1ba972492f307fdca7a7fd5c31c4b7c5
-
Filesize
314KB
MD57116848fd23e6195fcbbccdf83ce9af4
SHA135fb16a0b68f8a84d5dfac8c110ef5972f1bee93
SHA25639937665f72725bdb3b82389a5dbd906c63f4c14208312d7f7a59d6067e1cfa6
SHA512e38bf57eee5836b8598dd88dc3d266f497d911419a8426f73df6dcaa503611a965aabbd746181cb19bc38eebdb48db778a17f781a8f9e706cbd7a6ebec38f894
-
Filesize
90KB
MD574c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
8KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB