Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-01-2025 08:28
General
-
Target
JaffaCakes118_979cd2c035dbce6d66b94e537870a428.dll
-
Size
828KB
-
MD5
979cd2c035dbce6d66b94e537870a428
-
SHA1
e58fc8c4ecf4a730ca1f761ec4fcd55c40961b60
-
SHA256
e269355445b70397f7c8607c12c5010fa25010717851dce4318e120d43aa60e7
-
SHA512
b10644228a0805909c0343f45ed26066a75c9cc7e19554cd3d31381a2b36ef6369c87d436ae53af5eccb55a9b434ca238fda584952bd229ee6d80328a55f4d2f
-
SSDEEP
12288:qdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:MMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979cd2c035dbce6d66b94e537870a428.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\edl1UgEYg\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\edl1UgEYg\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\MR1S\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\MR1S\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\PrhxI\wextract.exeC:\Users\Admin\AppData\Local\PrhxI\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
832KB
MD5a312e4b75cdadf04031be82cccf99ebc
SHA19fc6ad9175be6c2c3134fefec2c9c774c3e82923
SHA256c72a592de1a367dc677d41d2ef023d8ead603de4c51325bcea0f2fbb72937961
SHA512b22ad64015804fadbb252ca51b973d52eb459312c63bb8ccbc48d51dd47c2e220c05b4566f72134bd6a8d873028f95784e3363655a294c6b2eda5817e4326a77
-
Filesize
832KB
MD584c6508fccbbe1de05d313c3dcd50ea2
SHA15e676bb50c7a56f19770b0b5d0a517754df61ded
SHA25645ac7dfdf10208f3e2534334543f308e5b16ca590d72dec661e217a3a9b2f925
SHA512a812857521c092df52d427c36fe4c7d46b3b34648c39d3b8b2cff7170b80a0ae347e2ad612ec03d8b934bdeb9fdcac2dd0637ecb3d55bf5565f8503615d10133
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.1MB
MD59ee7ea9ea170cba5fed46784ee684867
SHA1373f90138189487d5231dfbd71379e8e43dd3f9a
SHA256f2b6c936b87f4b0a8e657522c93d3868f2c3b2d73e24bfa40213580ab6ec978d
SHA512e3a751ea160557c41cfdfcb4d02f4c16bfe6ad3993478f77ddd44475a0ace1b1c446d67fbcd8e48f4e2f10f77c8786993b63ab44f228433f26ba60725637bdbe
-
Filesize
1KB
MD58b825b6fa8b62f02525c7e3bbbb218f1
SHA1f82e7c45725b7f738636fb3aa020b034e6f39b28
SHA2563c667cdbb68ddb4268a2a2b1f0a2e2c5129c8467bbc94b769d84d7cdb3c57a4a
SHA51257924569cb7f796b1200ceb08e1a9b790c641c8c71b4df231c7ded043e8d52f9d0b8fc3c62c0d25dbab4e77a4423ea27806b678a9e0b2114ecbe27b6034cb905
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
28KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
28KB
-
Filesize
832KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB