Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-01-2025 02:35
General
-
Target
JaffaCakes118_b98027835299cf468cc7169e702e732c.dll
-
Size
1.3MB
-
MD5
b98027835299cf468cc7169e702e732c
-
SHA1
19139b22e1752a8cfe0efe798baf533b96b2e7a6
-
SHA256
f5d450ab006b590227e1c2c39a32d9e47a43720120d3f8bde9b77b730be388c1
-
SHA512
ef3197919ba7ec1ddca732c1bd28cdde2598973dc12f0abe1c7a98ed05c1fb54c2fcb8ba94fae4eb4bea064b930681f6fe17aa0dede5ed2d838d3e0365cfe077
-
SSDEEP
12288:nVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ181:OfP7fWsK5z9A+WGAW+V5SB6Ct4bnb81
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b98027835299cf468cc7169e702e732c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\y0cRkZU3\Dxpserver.exeC:\Users\Admin\AppData\Local\y0cRkZU3\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\nGXp\notepad.exeC:\Users\Admin\AppData\Local\nGXp\notepad.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\F7hPYa\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\F7hPYa\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5785e3c8f918d87d1d453edf75c962e58
SHA18a84ac0590eaf0beb3dc3abac443150234cbf053
SHA2563b4f4dc3845bcd0aafbfd54c1c39d5aaa50c4ce2c6025201d37d1dcc80ea4a26
SHA512d8bcb83b41fd05fe5e8146338ee607f7bddb71638245c213a84d1e1f57bfe2e802f6ac0eeba762337c94080fea2c1aae96422ac3031d9c44d11f791c3f67943f
-
Filesize
1.3MB
MD5d7e0481eebba704f6895cfef3cace6ed
SHA14cccb573496baec421824876bdbf66a722c22408
SHA2566ad1e980dca1a2b49cc10af1cf4694fd8b153e3f49dd83e3528daa9d0f11d6ae
SHA5126c53a56875134efe633e0c22f7352fb408ea6227a1094d621c0071b70785f10bb8bbb78ad5f7cf3f6d1e59814e1d618930383230e939a8815867b4c3555a42af
-
Filesize
1.3MB
MD523d136c003c097ac9d117b4e3c214af3
SHA161acab5b2b39c4efee9d967ae254b6fa39c4ce3f
SHA256620c71d404bb4111100d83edb1cc53bd51b8af050391912d64cdfd1ac1af2fcb
SHA5125b96998ef9d166956c67100f526769649bc16677d5432a09ee2248dd068a29c83f742f6f460687fd116f7678992ea509221d6e44040228161bf14ee2aabd9433
-
Filesize
1KB
MD5776483740e7e88b9ea39cd5f89976b02
SHA144b98c3ee84c9b14f3ddec9282d3bcea9ca5529f
SHA256f135bb2b3a496bcb1d5e92d28c32f07ac306da1c5b9ac380a9fcf99322249b22
SHA512bec1a828a2777a0e5020089b63091b15e0f6be1f54cc2678d6b49b285bda360f6299b5b1f1d6d5c6b39d6060145251bd884835a12e2b98560edf79ded62718db
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
189KB
MD5f2c7bb8acc97f92e987a2d4087d021b1
SHA17eb0139d2175739b3ccb0d1110067820be6abd29
SHA256142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2
SHA5122f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB