Analysis
-
max time kernel
150s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
02-01-2025 09:02
General
-
Target
JaffaCakes118_63fbef9c63dc9858707e03078f23f1ce.dll
-
Size
2.4MB
-
MD5
63fbef9c63dc9858707e03078f23f1ce
-
SHA1
3a3aa0a1c6663551ee8e05fc2e6b17942fa83b96
-
SHA256
11066c2e0a1b0fe58bc9584918054340aa58179a79a3c8c6da49c63801d8ff2a
-
SHA512
e812c268e67ee8eeb46d6d8b50ca00c26e8db4784f99c15edd083b3583d999a1e65ffd46d7af87069d854b62edc956a26fe5ffd80d295efb2dd5126d6ed56956
-
SSDEEP
12288:tVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:0fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63fbef9c63dc9858707e03078f23f1ce.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\nrxFmiOL\calc.exeC:\Users\Admin\AppData\Local\nrxFmiOL\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\kMxqlc\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\kMxqlc\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\dEQeVU2\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\dEQeVU2\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD572d1f29a00611a317548da34b26f758e
SHA143a5b647d6fa621a6ffdf14c32b483aa9bd2ad2e
SHA25637b78909492d775ce046dad3dcc5dfe274cf408ba6fd707fa6ef2306416790ee
SHA512195cf8c1ea410aa241e4e54057ce8c8cefddb946866c372b4dc3fdbad4b23fd1a47b60a3eefe1eb1053d1e709ba02e145cc57a3305ed2c59413417086a38d10d
-
Filesize
2.4MB
MD5abe4d3dfc992978e2cb828fc114829b9
SHA133793a7f88829991741b8aa344800faf101e8c87
SHA256a6a731a922ab9ad596ec0b8c8b9dcee5494df838d194085f32bd0a15eb1e9071
SHA512d90f3c2bb69bcfda4a7263ada737b753e35e0e17c1deb2b358f70d9dec3643a5db93177cdad97f8cdf7a6099cb25d8ebf0b2c0f720848e62752792db5446ab92
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
1KB
MD5fdd8ea2438a78aed9463d12ceee09123
SHA10440b69a6c04e28dd5456c0abf74116cd2e3a711
SHA256b81edf1397af13e98189e86d29d942fa8f49c832d129f0be915dc0065a3a0ee4
SHA5123f8ba9ad8c1cae96869fddc005b5e61e0e598b9a8eecf48526ded3b78cf1c37725cddc93ac89b8861a27589302a8fb8d1774f9c1c5a8c88aab0fb6d309b54add
-
Filesize
80KB
MD5bd889683916aa93e84e1a75802918acf
SHA15ee66571359178613a4256a7470c2c3e6dd93cfa
SHA2560e22894595891a9ff9706e03b3db31a751541c4a773f82420fce57237d6c47cf
SHA5129d76de848b319f44657fb7fbe5a3b927774ae999362ff811a199002ffa77ad9e1638a65a271388e605ab5e5a7cb6ce5aa7fcabc3ed583ade00eaa4c265552026
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
2.5MB
MD51e26d5931962498440ed4f1904d06137
SHA1ae7f06a094ee8a02ced10943785eb4a864e4ae4a
SHA2562a32f11c583bc3b6afe8074626ec224d3529bb3910827af24468986dec52e9cd
SHA512a86ee3734be0a5dafce90ae47dda71cd8f95e498b7aacb73b16018bc135c716093911d860c6ceb7dc44b1227911e34571939c22054b325d941d959a9bc348ebe
-
Filesize
28KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
28KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
28KB
-
Filesize
2.4MB
-
Filesize
28KB
-
Filesize
2.4MB