Malware Analysis Report

2025-05-28 17:25

Sample ID 250515-e2plhafp5v
Target JaffaCakes118_04463233364b1cc3f51e1f51e42a37c8
SHA256 68d435607aa9bbc1fb27b084a7851140e77afe279443c65f027d4277e888752f
Tags
dridex botnet defense_evasion payload persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

68d435607aa9bbc1fb27b084a7851140e77afe279443c65f027d4277e888752f

Threat Level: Known bad

The file JaffaCakes118_04463233364b1cc3f51e1f51e42a37c8 was found to be: Known bad.

Malicious Activity Summary

dridex botnet defense_evasion payload persistence privilege_escalation trojan

Dridex family

Dridex

Dridex Shellcode

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Unsigned PE

Event Triggered Execution: Accessibility Features

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-15 04:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-15 04:26

Reported

2025-05-15 04:28

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_04463233364b1cc3f51e1f51e42a37c8.dll,#1

Signatures

Dridex

botnet dridex

Dridex family

dridex

Dridex Shellcode

botnet payload
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3623617754-4043701611-775564599-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kidykkjkirnxz = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\TEMPLA~1\\LIVECO~1\\16\\User\\DOCUME~1\\1033\\MVy0P2Xe\\SYSTEM~1.EXE" N/A N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\bGHf2Mj2\Utilman.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\2oKxvID\SystemPropertiesProtection.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\DOCUME~1\1033\MVy0P2Xe\SystemPropertiesProtection.exe N/A

Event Triggered Execution: Accessibility Features

persistence privilege_escalation

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3556 wrote to memory of 4680 N/A N/A C:\Windows\system32\Utilman.exe
PID 3556 wrote to memory of 4680 N/A N/A C:\Windows\system32\Utilman.exe
PID 3556 wrote to memory of 2868 N/A N/A C:\Users\Admin\AppData\Local\bGHf2Mj2\Utilman.exe
PID 3556 wrote to memory of 2868 N/A N/A C:\Users\Admin\AppData\Local\bGHf2Mj2\Utilman.exe
PID 3556 wrote to memory of 4432 N/A N/A C:\Windows\system32\SystemPropertiesProtection.exe
PID 3556 wrote to memory of 4432 N/A N/A C:\Windows\system32\SystemPropertiesProtection.exe
PID 3556 wrote to memory of 1564 N/A N/A C:\Users\Admin\AppData\Local\2oKxvID\SystemPropertiesProtection.exe
PID 3556 wrote to memory of 1564 N/A N/A C:\Users\Admin\AppData\Local\2oKxvID\SystemPropertiesProtection.exe
PID 3556 wrote to memory of 888 N/A N/A C:\Windows\system32\cmd.exe
PID 3556 wrote to memory of 888 N/A N/A C:\Windows\system32\cmd.exe
PID 3556 wrote to memory of 632 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 3556 wrote to memory of 632 N/A N/A C:\Windows\system32\Dxpserver.exe
PID 3556 wrote to memory of 4688 N/A N/A C:\Users\Admin\AppData\Local\3R7hJ2\Dxpserver.exe
PID 3556 wrote to memory of 4688 N/A N/A C:\Users\Admin\AppData\Local\3R7hJ2\Dxpserver.exe
PID 888 wrote to memory of 2924 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\DOCUME~1\1033\MVy0P2Xe\SystemPropertiesProtection.exe
PID 888 wrote to memory of 2924 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\DOCUME~1\1033\MVy0P2Xe\SystemPropertiesProtection.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_04463233364b1cc3f51e1f51e42a37c8.dll,#1

C:\Windows\system32\Utilman.exe

C:\Windows\system32\Utilman.exe

C:\Users\Admin\AppData\Local\bGHf2Mj2\Utilman.exe

C:\Users\Admin\AppData\Local\bGHf2Mj2\Utilman.exe

C:\Windows\system32\SystemPropertiesProtection.exe

C:\Windows\system32\SystemPropertiesProtection.exe

C:\Users\Admin\AppData\Local\2oKxvID\SystemPropertiesProtection.exe

C:\Users\Admin\AppData\Local\2oKxvID\SystemPropertiesProtection.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\DOCUME~1\1033\MVy0P2Xe\SYSTEM~1.EXE

C:\Windows\system32\Dxpserver.exe

C:\Windows\system32\Dxpserver.exe

C:\Users\Admin\AppData\Local\3R7hJ2\Dxpserver.exe

C:\Users\Admin\AppData\Local\3R7hJ2\Dxpserver.exe

C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\DOCUME~1\1033\MVy0P2Xe\SystemPropertiesProtection.exe

C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\DOCUME~1\1033\MVy0P2Xe\SYSTEM~1.EXE

Network

Country Destination Domain Proto
GB 2.16.153.224:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.251.37.35:80 c.pki.goog tcp

Files

memory/808-0-0x0000017DE3030000-0x0000017DE3037000-memory.dmp

memory/808-1-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-6-0x00007FFF88BFA000-0x00007FFF88BFB000-memory.dmp

memory/3556-4-0x0000000002860000-0x0000000002861000-memory.dmp

memory/3556-10-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-23-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-61-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-83-0x00007FFF8AAC0000-0x00007FFF8AAD0000-memory.dmp

C:\Users\Admin\AppData\Local\bGHf2Mj2\DUser.dll

MD5 b9edc40a26b469b2488fbaaa477dbf84
SHA1 3521efe7ef870c2bf31eaf081b10dd3854a21b27
SHA256 720f66cc4d1d2f0c58ed33601c9e092eb4421eec29c87d67c9e00edc3f856b4c
SHA512 b082f9354b7274e2fc06a6af49b16e4bb2012dfcd40918f7a4ecbd54dd3e63b9514b3cf7c8919c28d8d60f1c619e876de870b1c44620bb4acff5c4da06570637

memory/2868-95-0x000001B0EC1B0000-0x000001B0EC1B7000-memory.dmp

C:\Users\Admin\AppData\Local\bGHf2Mj2\Utilman.exe

MD5 a117edc0e74ab4770acf7f7e86e573f7
SHA1 5ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256 b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA512 72883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97

memory/3556-82-0x0000000000E30000-0x0000000000E37000-memory.dmp

memory/3556-60-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-59-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-58-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-57-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-56-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-55-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-54-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-53-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-52-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-51-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-50-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-49-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-48-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-46-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-45-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-44-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-43-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-42-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-41-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-39-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-38-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-37-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-36-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-34-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-33-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-32-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-31-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-30-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-29-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-28-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-27-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-26-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-24-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-25-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-22-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-21-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-20-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-18-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-19-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-17-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-16-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-15-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/1564-107-0x000001E853C10000-0x000001E853C17000-memory.dmp

C:\Users\Admin\AppData\Local\2oKxvID\SYSDM.CPL

MD5 7bdcc619a8d30180f7e918b3572c937a
SHA1 4bb24aa95165112a1507906acefa11f07498b725
SHA256 f1043d967d46fff7357dc112dcf9c56150268bd79ea019e7cf2d5d9886788475
SHA512 729a041b54f93b2424c9d11b5aedd586e68ed07cc1fd582fc8f81baa46c39fa92cc67638ca83e931f940b9189e30b02362f43d1d44d7ca22e27cf1910cdd75b9

C:\Users\Admin\AppData\Local\2oKxvID\SystemPropertiesProtection.exe

MD5 26640d2d4fa912fc9a354ef6cfe500ff
SHA1 a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256 a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA512 26162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc

C:\Users\Admin\AppData\Local\3R7hJ2\XmlLite.dll

MD5 8c953fe0dedac9226c456f61788e75f8
SHA1 59a49da87d321fc7ebc51bc92c311dc77ae2213d
SHA256 7efc810e22154f9fb659fa109dd05d584eba68fb1169887eecb2fa405a484edd
SHA512 0388eb1cb3ab219a31f4b7161f84c846e9a6bd73c29d94f4975ab9829c5022709bdbb96ec9aa05ca1ab50372e7f477544efa86db79146cb0576c56e1d0dafa88

C:\Users\Admin\AppData\Local\3R7hJ2\Dxpserver.exe

MD5 6344f1a7d50da5732c960e243c672165
SHA1 b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256 b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA512 73f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65

memory/3556-14-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-13-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-12-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-11-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/808-9-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-47-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-40-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-35-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-8-0x0000000140000000-0x00000001401DF000-memory.dmp

memory/3556-7-0x0000000140000000-0x00000001401DF000-memory.dmp

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dxsnejruwmwjo.lnk

MD5 976b3930779480d7aab29232bdf1bccc
SHA1 e4710c51754a125c8a4ec63129e6dd1275a51289
SHA256 5c8fb1459dce1d1a42007b97420a802b07bab7b77d1a8edef39fa6c6c5595e08
SHA512 a490ee99c4e0ff060b1f541f1c57ce0d0d18fac3641fd2241afa323835151c312b99727296cd2ea2d00e196d3a55805b3255c96c3573277a5e7d48383dccc10d