Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-01-2025 08:28
General
-
Target
JaffaCakes118_979cd2c035dbce6d66b94e537870a428.dll
-
Size
828KB
-
MD5
979cd2c035dbce6d66b94e537870a428
-
SHA1
e58fc8c4ecf4a730ca1f761ec4fcd55c40961b60
-
SHA256
e269355445b70397f7c8607c12c5010fa25010717851dce4318e120d43aa60e7
-
SHA512
b10644228a0805909c0343f45ed26066a75c9cc7e19554cd3d31381a2b36ef6369c87d436ae53af5eccb55a9b434ca238fda584952bd229ee6d80328a55f4d2f
-
SSDEEP
12288:qdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:MMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 7 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979cd2c035dbce6d66b94e537870a428.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\lRnnuCem\isoburn.exeC:\Users\Admin\AppData\Local\lRnnuCem\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\mLoxhEI\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\mLoxhEI\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\TQNIWsHm\dwm.exeC:\Users\Admin\AppData\Local\TQNIWsHm\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
832KB
MD56c768f3f729a79598fc6aebd97d7b219
SHA18a5eab93e0d303c139f028c3e496239970ce9316
SHA256a2f1b2cf59785aaa433b6ec6298aa391f9c806e4e90ed7a62cda2d356ee6d34e
SHA512d3df953371f1d55bdff0025a225caeffe8269b36283cf5bf95ae7005aeace4b3a3bc7cdbf1c3227958b65652d818a6d38e1c41805292198818ac4f3ac3cddc41
-
Filesize
89KB
MD5f8051f06e1c4aa3f2efe4402af5919b1
SHA1bbcf3711501dfb22b04b1a6f356d95a6d5998790
SHA25650dcb4be409f50d26c0fc32dd9cdbf96bff4e19bf624221cb566ebeb3e09ce1a
SHA5125f664d937abe4426ee7e0d8491a395f9ef4ffe7a51dba05b54b7ba27e80c9be37833400911c5878d3dec659f4fa1579ec8ba4cfc485fb2ce24dd37c321006daa
-
Filesize
832KB
MD5f558235a293721d70f41342f0d13f6ad
SHA194e8d1d90a398ddc9b72ae9500f2565afe5a2158
SHA25657e418a774a7b820265cb5a976b1fe7416440b62c0d1739882c8256c1a908f6c
SHA512be956c7e1dcf565e7798ce19c2ef7051e32b322120e2250a39d8ad052d00f9149aaa496215118d63b7284d1c53697f08cdd59086be50c561dd33904f36c37e74
-
Filesize
1KB
MD5372df99572bb3c63f964df96d45208f4
SHA1970bd291d0d78045887060ead241175e70576c4b
SHA2567b49456d470fcc287bc03bc5442e58e5866ea633c38ea5c419b63309d92237b0
SHA5120caa2c922c886752487c68eda9a59a27e0a0728db2454f7e19901c4cd215344740bad1fbd3453d3f92b8cb87f808a825458aea7f5de6002bf5f82a6e5903ff4b
-
Filesize
117KB
MD5f162d5f5e845b9dc352dd1bad8cef1bc
SHA135bc294b7e1f062ef5cb5fa1bd3fc942a3e37ae2
SHA2568a7b7528db30ab123b060d8e41954d95913c07bb40cdae32e97f9edb0baf79c7
SHA5127077e800453a4564a24af022636a2f6547bdae2c9c6f4ed080d0c98415ecc4fbf538109cbebd456e321b9b74a00613d647b63998e31925fbd841fc9d4613e851
-
Filesize
832KB
MD5dc3925710c9bc9d7005358aff2425930
SHA1384ad22265a55f828636cd6b1f8a7a0d336c5bd3
SHA256c726086f039e5f56f0bb940df5cd9e818bacaf2f5d404ae34ffa8c754c54dc68
SHA5121ca9c627720e5611fbad60e8178eabf1a9f098848a86a4b78db5bfdeb26c973f9618d2720b6fa0b22873536f801ed9b98de53e97b5232a61e40d0a61a60f2eb1
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB