Overview

overview

10

Static

static

10

3e783a62c7...18.exe

windows7-x64

7

3e783a62c7...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 07:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118.exe
  • Size 50.5MB
  • Sample240513-js5ctagd53
  • SHA256 8fc12ed1e2754db5054c1c53cdd09e4ff829c180294b4a29b078b41df0bfdc7d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\MsgCenter.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\MsgCenter.exe" /service /stop
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5012
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe" -p 2 -i 3#"C:\Program Files (x86)\Baidu\BaiduBrowser\"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3616
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe" -p 2 -i 2#"C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1496
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe" -p 2 -i 5#""#""
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:208
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe" -p 2 -i 12#install
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1160
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\MsgCenter.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\MsgCenter.exe" /service /start
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5044
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe" -p 2 -i 1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4828
    • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe
      "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe" -p 2 -i 13
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:4748
  • C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\MsgCenter.exe
    "C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\MsgCenter.exe"
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    PID:4204
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1664 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3924

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          BrowserLoader.dll
          • Path C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\BrowserLoader.dll
          • Size 426KB
          • SHA256 b650cdce8cf2d040c5986479d2b2915657d1fcd865fce5345f9f58670222dd73
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CommonWorker.dll
          • Path C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\CommonWorker.dll
          • Size 205KB
          • SHA256 41c5b10bc8fcd18b2ebca66ba50ce15c7112cdbaf9b37b1137f04b045eacc4f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          private_favicon.ico
          • Path C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\LocalPages\apps\private\private_favicon.ico
          • Size 9KB
          • SHA256 caaaca3167baaf5cab1b23f564f001181261e58906e56d86f6267784b747bd69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          PluginMgr.dll
          • Path C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\PluginMgr.dll
          • Size 660KB
          • SHA256 171004985ad8f625164d42c460ab199912a61eaca7ad85eeacd6c9c84ec7f839
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          baidubrowser.exe
          • Path C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\baidubrowser.exe
          • Size 59KB
          • SHA256 ebc9661ec4d524913e157315d98ff6a30b557747d49bc8196d7c03d0f400ecf6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msgcenter.exe
          • Path C:\Program Files (x86)\Baidu\BaiduBrowser\7.6.502.2763\msgcenter.exe
          • Size 104KB
          • SHA256 149bb5c6c0d83232f8da9f7394aa6172783d8c07e06c2bb575cd15c4e1ae40ad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          百度浏览器.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度浏览器\百度浏览器.lnk
          • Size 1KB
          • SHA256 c97cdbe7251ec0b2203f86a60d6be72bf033dd6f0a3b83e695c5a8fbef557ca1
          • MD5 SHA1 SHA512
          Submit Download

          bdb_setup.log
          • Path C:\Users\Admin\AppData\Local\Temp\bdb_setup.log
          • Size 2KB
          • SHA256 7edff82a01fe36a1c26ecc8df2298b79eba05f894572eb8cbd50f857875272a1
          • MD5 SHA1 SHA512
          Submit Download

          bdb_setup.log
          • Path C:\Users\Admin\AppData\Local\Temp\bdb_setup.log
          • Size 191B
          • SHA256 c39fa2f3e37f95fc163d0dbe4ab811a91a93c1556df1bc0c59bd980f0ba922ce
          • MD5 SHA1 SHA512
          Submit Download

          bdb_setup.log
          • Path C:\Users\Admin\AppData\Local\Temp\bdb_setup.log
          • Size 491B
          • SHA256 6843af368388675bcfc3e65f9a49c9bb0f7d5b0320ea420f7b4f8eb856b0101d
          • MD5 SHA1 SHA512
          Submit Download

          bdb_setup.log
          • Path C:\Users\Admin\AppData\Local\Temp\bdb_setup.log
          • Size 986B
          • SHA256 672cf60904b2baa206bd200f037e255538f97d778460536f1a4e8aa34fc87d65
          • MD5 SHA1 SHA512
          Submit Download

          bdb_setup.log
          • Path C:\Users\Admin\AppData\Local\Temp\bdb_setup.log
          • Size 1KB
          • SHA256 b9b5dee44be2d8435ae82e84ac838bf107a633abbe3b6362cb6ff3331a1470fd
          • MD5 SHA1 SHA512
          Submit Download

          bdb_setup.log
          • Path C:\Users\Admin\AppData\Local\Temp\bdb_setup.log
          • Size 1KB
          • SHA256 31f3e05f64a35db163cb6fcb8f9e95f2b8b90a325c4b5793ab4f3ac438fb0c7a
          • MD5 SHA1 SHA512
          Submit Download

          BDWebDownload.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\BDWebDownload.dll
          • Size 314KB
          • SHA256 55c6538797c18236c9e3e9bc76b617a7157481a968de6704d0568805b96a232a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Base.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\Base.dll
          • Size 1003KB
          • SHA256 7df698d53bf96416249068fbdb2b15df1019a34887021c4e1bcaf75264094664
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          InstallBDMSkin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\InstallBDMSkin.dll
          • Size 1.4MB
          • SHA256 96e2e381bacdf69d3f2455f8442d8922c75226229b79681296edf864f88b7421
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          InstallHelper.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\InstallHelper.dll
          • Size 380KB
          • SHA256 d724191c18ebca3b5ec5004b5cf963379a9361d295256023277e091b65656fbf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Protocol.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\Protocol.dll
          • Size 324KB
          • SHA256 eeae31ad3bfe19ee3713d09c64e0e4588cd63d3695eb85737bdeaadd28231a8e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Report.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\Report.dll
          • Size 105KB
          • SHA256 9f7c4ae9eac4161b85e5b61aed07a738fcf79bbfb5749303dc512bf6a0eaa47a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\System.dll
          • Size 29KB
          • SHA256 e820734c8fa2d64791b44bca2e6260c9e17c7409bc0243d14379aea73ffbcaeb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Utils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\Utils.dll
          • Size 2.1MB
          • SHA256 a4f0fee8defc730fb680ee1a8cbca9b8e0be29b6f9e0c16fe3e21bd002ea1d77
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bdlog.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\bdlog.dll
          • Size 102KB
          • SHA256 d7a6c53bb11e61e8739ebd055f8550649c0614396295c98f5e54f8b2c1ee504a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvcp100.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\msvcp100.dll
          • Size 412KB
          • SHA256 94ba9c27c85e126c084bb01c99f6a863338b8ae41c9449c576b7ebfd8deecad8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvcr100.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshFF02.tmp\msvcr100.dll
          • Size 753KB
          • SHA256 cfca55270f4e7d9188028cfb13e051f09d894f75b4d31fb5ee16ca5685de2f38
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GlobalPluginInfo.xml
          • Path C:\Users\Admin\AppData\Roaming\Baidu\BaiduBrowser\plugin\7.6.502.2763\GlobalPluginInfo.xml
          • Size 5KB
          • SHA256 42f55302ac28669d7c40fbf7ff3529993ec448e900206d7fbfc833cba002716d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          PluginSetup.xml
          • Path C:\Users\Admin\AppData\Roaming\Baidu\BaiduBrowser\plugin\extends\{C060303D-ECBF-4D67-9B86-C48DC33EC8F0}\7.6.100.234\PluginSetup.xml
          • Size 707B
          • SHA256 2e144dfbecc10852bb3e0bd037f2b6e089a151abe099491e1341e851651d3cc9
          • MD5 SHA1 SHA512
          Submit Download

          百度浏览器.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\百度浏览器\百度浏览器.lnk
          • Size 1KB
          • SHA256 91515e5db924e99272b731a105e4040980361160fb263ef8fe4bf6a8d5ee1ae9
          • MD5 SHA1 SHA512
          Submit Download

          memory/208-1435-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/208-1450-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/1160-1018-0x000000006FFF0000-0x0000000070000000-memory.dmp
          Download

          memory/1160-1019-0x000000006FFF0000-0x0000000070000000-memory.dmp
          Download

          memory/1160-1106-0x0000000003990000-0x0000000003CB3000-memory.dmp
          Download

          memory/1160-1328-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/1160-1101-0x00000000036C0000-0x000000000376A000-memory.dmp
          Download

          memory/1496-1395-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/3616-1331-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/4204-1439-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/4748-1392-0x0000000075E60000-0x0000000075EC3000-memory.dmp
          Download

          memory/4748-1391-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/4748-1366-0x000000006FFF0000-0x0000000070000000-memory.dmp
          Download

          memory/4828-1437-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/5012-961-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download

          memory/5012-958-0x000000006FFF0000-0x0000000070000000-memory.dmp
          Download

          memory/5012-959-0x0000000077702000-0x0000000077703000-memory.dmp
          Download

          memory/5044-1377-0x0000000075C40000-0x0000000075E55000-memory.dmp
          Download