Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 21:46
General
-
Target
fd3e806f4332bfcfa93533beca89df80_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
fd3e806f4332bfcfa93533beca89df80
-
SHA1
d11032403375abd3d628e983a64ab2d80ab476c7
-
SHA256
2804e639a5387ba5851a66fd0aca15bec2e3e20fcedbe56b93136828af8e933b
-
SHA512
ed0bd11263b65dda4794aba95bbfa621c83377230ef333e89e245ec96befb231fa513b43937e0814d54591bef0faceeba7ffe11915e90191a0fb0cb74e7c4d0f
-
SSDEEP
12288:lVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:8fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3e806f4332bfcfa93533beca89df80_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\45M1QyOKW\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\45M1QyOKW\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\6Cne\MpSigStub.exeC:\Users\Admin\AppData\Local\6Cne\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\Pd6\ComputerDefaults.exeC:\Users\Admin\AppData\Local\Pd6\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD543e65e1a392418e986eac0c8b38d308e
SHA1008c33d1086f0f0f9eb2769ac1901e0d103e1b76
SHA256e878b49abc261bd5b58d398ab602e2a0fd8b05eb2e7172215c07c7875114337b
SHA51276468c41dd7e9772c4138ba8261fd3d0df854bcf6491e81680dcf81e45115a86b37b450b69f53a95fbceeb136f5e541a0c3c191631cd20fccf90e5d07155f7a5
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
Filesize
1.2MB
MD50cf1ae4c01eda77f5920a062a1e5d512
SHA1c58e2dbf27322b4f11be5be42c81373ee83b6ecb
SHA2568d3a03a9346fd21d32ed13e363d617bf65e8742a0271bb1e26288b7b94d680b9
SHA5124e6a1e57b43b3238a16dada5092167da66673ed6ac6fe2c23f5ab8fdf5ba6612c624684b94140fc4c919cc72719a808eae38deab7a54e3a557aea8defbd2e492
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
1.2MB
MD5d352335c432da40a27e049813a4be4cf
SHA1c852750a6ebbc02ec31aad08f980142b6600d6e5
SHA256a75134e2a3618a2da67031328b95fab8b33306cc2a484c0789f4a7c2b0985cc7
SHA5126430b5dbfcabbae2684b1c21701edd30ec80fb98b69c864f4876c839b9cc9806e23a8b19719151e937e74a653559e4d244f26d1faa0e0dc4c6226b776581f3b1
-
Filesize
1KB
MD55d07eed25c9bf3ab32cabe21240d6f38
SHA19af5336abac23f9d514539425fe468e242c5a65d
SHA2565950bc2eafcd766ce69c9ba7ee4210c4262e5ecee8ccebb312e87e3de5fefc87
SHA51214fdd85b316ab422626cf2cd25a7cfd8949eb783d72f0dad1771404540aa2e325d1773409140454137403467331bcde81cb6d5e15e247fdfb7d39aaea68a991c
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB