Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
16-12-2024 03:24
General
-
Target
f7133de222c3ca628bff0e9dffd3856d_JaffaCakes118.dll
-
Size
844KB
-
MD5
f7133de222c3ca628bff0e9dffd3856d
-
SHA1
730fee2d15b2fa3dbcd8439a4768609c1b57d24b
-
SHA256
c827d79e23b4ebccbb744242035c6b5b48a7ae508184feea284c38706fd91c0a
-
SHA512
ef3812e9a500d5fc47b4b48360e581150618bca15863c85f52a5cd60e81a8a6d89bea44bcbfa0ff8a76ffd81f818746bc8e10ec2533e1056a1e7458cd68372ee
-
SSDEEP
12288:ydMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:EMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7133de222c3ca628bff0e9dffd3856d_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\S7mqnpfVx\sigverif.exeC:\Users\Admin\AppData\Local\S7mqnpfVx\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\aDi\wbengine.exeC:\Users\Admin\AppData\Local\aDi\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\fqIQ\iexpress.exeC:\Users\Admin\AppData\Local\fqIQ\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
848KB
MD59e2f74d7fd4a032b1cf631fb0dfa0698
SHA1423556a1ba4d0e25bd861eb0a50e8e976484cf7b
SHA2560504ed2f95605afaf6ba3a875ccdb6df09e99162d110fec6b1b2cdda7d3c4b3e
SHA512f2102dcf754ca624259abc817a60832da12600c912fdb869824b76f4d0e475392527d31463515ed446531ad4082440c4bdf22e4ac3544ddd4d4df96c6a3d8dc2
-
Filesize
848KB
MD5034964343d0c848bbdb8d53859ed8a4d
SHA18450cf8f69d8660e794ebef704f0388bddfa6a93
SHA256771b675d77f96700fc8668cd39815d9fe1d4c3dda9e572d2e03073f4b80ef5c9
SHA5123413b687d8b2d689575d09ba2ab7d55ee90a417aef9cbb83296ea7c4cfc6d08bddf482478d308bb372180ba139508a0a3ebf800e4330c079c1ecf922e9764d07
-
Filesize
848KB
MD59415552ee9663aad9f78c74dbb110382
SHA12627ff420dbb41e79123a63b6d872c3a8c2e46bb
SHA256b2da638568318a73dcfe01a5458bf53bf8ce64c96f779a0e922f9ab9d7f60f43
SHA512fa61f1ef8775b76f65191f6eb581a843ba418a3d61bafb6d7ec216f1b8d1acb229345041fb3cae0b7136699d9d7d05328ebeb673038e015efb3269bf6b2cc5d1
-
Filesize
1KB
MD5120f411ed2ca2653f4f8ff89003c0381
SHA11480f125ccd80e189adc75ad4fc6d03cfd94e2c4
SHA256007ff0bcd378ce77bfb7309f26f330a12fab5f3cc83b4c88c6bfcb92463aee79
SHA512998d9d720991e672b7f36ff1e75d7ead90634c612bfa11bae7113bd847f25f225c56e11223aee6b4d33031c4fc8b0089eac038bf14709caf2acf0c05679d7d2a
-
Filesize
73KB
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
4KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
28KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
28KB
-
Filesize
844KB
-
Filesize
848KB
-
Filesize
28KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
28KB