Overview
overview
7Static
static
1752b8a6b45...18.exe
windows7-x64
7752b8a6b45...18.exe
windows10-2004-x64
7$PLUGINSDI...ol.dll
windows7-x64
1$PLUGINSDI...ol.dll
windows10-2004-x64
1$PLUGINSDI...rt.dll
windows7-x64
1$PLUGINSDI...rt.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/chkm.dll
windows7-x64
1$PLUGINSDIR/chkm.dll
windows10-2004-x64
1$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...up.dll
windows7-x64
3$PLUGINSDI...up.dll
windows10-2004-x64
3$R0/$R0/Ba...up.exe
windows7-x64
1$R0/$R0/Ba...up.exe
windows10-2004-x64
1$_24_/Pers...x.html
windows7-x64
1$_24_/Pers...x.html
windows10-2004-x64
1$_24_/Pers...ent.js
windows7-x64
3$_24_/Pers...ent.js
windows10-2004-x64
3$_24_/Pers...mon.js
windows7-x64
3$_24_/Pers...mon.js
windows10-2004-x64
3$_24_/Pers...fig.js
windows7-x64
3$_24_/Pers...fig.js
windows10-2004-x64
3$_24_/Pers...ram.js
windows7-x64
3$_24_/Pers...ram.js
windows10-2004-x64
3BDBugReport.exe
windows7-x64
1BDBugReport.exe
windows10-2004-x64
1BDBugReportx64.exe
windows7-x64
1BDBugReportx64.exe
windows10-2004-x64
1BDDownloadExe.exe
windows7-x64
6BDDownloadExe.exe
windows10-2004-x64
6Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
752b8a6b45ceb452cd4ef28e8f9d3965_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
752b8a6b45ceb452cd4ef28e8f9d3965_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Src/Protocol.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Src/Protocol.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Src/Report.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Src/Report.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/chkm.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/chkm.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/insthelper.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/insthelper.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/reportsetup.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/reportsetup.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$R0/$R0/BaiduPinyinWin10Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$R0/$R0/BaiduPinyinWin10Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$_24_/PersonalCenter/$_25_/index.html
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$_24_/PersonalCenter/$_25_/index.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$_24_/PersonalCenter/$_25_/js/achievement.js
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$_24_/PersonalCenter/$_25_/js/achievement.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$_24_/PersonalCenter/$_25_/js/common.js
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$_24_/PersonalCenter/$_25_/js/common.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
$_24_/PersonalCenter/$_25_/js/config.js
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
$_24_/PersonalCenter/$_25_/js/config.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
$_24_/PersonalCenter/$_25_/js/tangram.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$_24_/PersonalCenter/$_25_/js/tangram.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
BDBugReport.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
BDBugReport.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
BDBugReportx64.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
BDBugReportx64.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
BDDownloadExe.exe
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
BDDownloadExe.exe
Resource
win10v2004-20240226-en
General
-
Target
BDDownloadExe.exe
-
Size
367KB
-
MD5
2f5aa7abfbbf2b087f9e4dfe423bd6a1
-
SHA1
c54a1c7d55272efc2733eea8c92e4e5d5b88c36d
-
SHA256
68ed1dc5216bc98e95b938643b44160805fb9564966ba3baa515df526ce6cff0
-
SHA512
f296c689b22ccf8d55f385e22f29e5e7e059daa44577eba05a8e42706abae4c9292c16fc9fe44d671ffb816960e69317aa5fbafb7e0702acf4f2608c6c0db719
-
SSDEEP
6144:AJwx+zTO02TvEUSzi1G6/InjNx9LtEmCR1/gxKrpU1QUTive:AJwx+zTBtzi18xzBEmCRixBive
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 BDDownloadExe.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe 2036 BDDownloadExe.exe