Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-12-2024 12:29
General
-
Target
JaffaCakes118_1b5fc75cf7f17eb8d9d318b771073b45.dll
-
Size
1.4MB
-
MD5
1b5fc75cf7f17eb8d9d318b771073b45
-
SHA1
8c25138e7db9e384da66bcf7fdb1697ab9efafbc
-
SHA256
82288b7e8104a0143320ded6d208837fdacbd5046c0a1e064297a7055b5b8f8e
-
SHA512
15af9016735a827ca76c0c874641043d3782f9eb3c8c65f08cf37d007188a9af78bc32b526db164981dc6c750fbb751d58180a38636c6c94ebe1c8aa59dc512e
-
SSDEEP
12288:LdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:JMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b5fc75cf7f17eb8d9d318b771073b45.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\9NIRMmIk\dialer.exeC:\Users\Admin\AppData\Local\9NIRMmIk\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\7k5YLQf\sethc.exeC:\Users\Admin\AppData\Local\7k5YLQf\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\Rx4ZgnmbB\DWWIN.EXEC:\Users\Admin\AppData\Local\Rx4ZgnmbB\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
1.4MB
MD57329f255dc0d7f92732c5254e5b4ab4d
SHA1c81ddbbeca2022809afef14305c6260b15c1ddf5
SHA2561fe59d3dce8c9a500f14381ff383432f80b5578db6f611a20d714bc45096d9c0
SHA512f28d3403c7e5dc77b9ffb695630f2cb088d9d335134848850ad56d660d6c033087c8bcaa0ef03269f937d19fb3943751a86a7ed3822922365f104ec5bb95d87e
-
Filesize
34KB
MD546523e17ee0f6837746924eda7e9bac9
SHA1d6b2a9cc6bd3588fa9804ada5197afda6a9e034b
SHA25623d8a6a1d847a324c556c30e10c8f63c2004aeb42ac3f5a5ca362077f1517382
SHA512c7117c3778650864e685bd89df599d7cdd9319d757344ddc7cfd9403d6673964127f6ff0c5ac48455fd3097af31a6ff09173f85dfa7be2d25f395cdf3692bb9a
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
1.4MB
MD55d809a30e4a3d97304d3158d9f363512
SHA1bd0ae277ab9fbd1804a35469d27df114bc036c48
SHA256855be21a05605a7183f6622f7a85ff12c0c811aa9de74b95603ecb95f83f23f0
SHA51230ed10e0ce0326b1216ebdb57fb3a1e2ffe2427bf8bdd2d53b0403e5f1dbab8d52b2e1eacc6b7a8ef6da4388af6c0fd8c4d556e591987737bb49f1ed7fc1778e
-
Filesize
1KB
MD52da7bf2a2782fe65f7c342e0d92bbe5e
SHA14f95d834ecbcea63c0a74957a9bb050903c47b99
SHA25666060ff6e48b2dfc3bf973a0736806bc2342d31a8480daee45a22ebe3f097f1f
SHA5120dd352a9b41fa23af713c60083f39ea066ca5630876e96fb3a389540ecee545f89d8998556d7484945848b078706af1035c5ad810ec565e1b67ea2a467051011
-
Filesize
1.4MB
MD533dcddac5499e2e9495164c7eb1a9e70
SHA1ded901c66bdc79e57f81fa48a4031345bbbe6f2e
SHA256eacacc88fc33c007ecc04c66a6967d751067d6b6bf68fa501b0cf8678da6ebdb
SHA512328f6fd4ed7370acb41766c85d3e437cf5c96c3965582fc50bef294cfcd7c0ab697c5bd670bfe935fb108adedcd45191fe3a2d2913fdf184bd5e891c647b03ef
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB