Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
01/01/2025, 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
150 seconds
General
- Target JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe
- Size 169KB
- Sample250101-x9ltpaspal
- SHA256 ce435ba894f3737d0abe06180b9114e20d122240fded0685bd63db4a020a7a83
- MD5 60433a5ba519475e6faa1a4f7210bc20
- SHA1 0bafd67adf0969d28ef14d836b7c9e8219c93780
- SHA512 7d1603ab400ba232c1968cd662af3a705e1313f8d912d52a2a30e40f1fb79bce34a18e98ef38837a936e847b5d8b4e738923d0af4572e7cf77011fd1326a861f
- SSDEEP 1536:9I2t937an08bcn6kwOgKhlgvwf+l+OBDY4f2XdR7TPk3BfEBZWEzMNGCq2iW7z:tbadAn67Ogvl+qlKdR7TPk8XWEzQGCH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Bdaejec family
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4644-8-0x0000000000900000-0x0000000000909000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023b2b-4.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation esS.exe - Executes dropped EXE 1 IoCs
pid Process 4644 esS.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE esS.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe esS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE esS.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe esS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe esS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE esS.exe File opened for modification C:\Program Files\7-Zip\7z.exe esS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe esS.exe File opened for modification C:\Program Files\dotnet\dotnet.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe esS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe esS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe esS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe esS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe esS.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe esS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE esS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe esS.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe esS.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe esS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe esS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE esS.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe esS.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe esS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe esS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe esS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE esS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE esS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe esS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe esS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language esS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3764 wrote to memory of 4644 3764 JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe 83 PID 3764 wrote to memory of 4644 3764 JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe 83 PID 3764 wrote to memory of 4644 3764 JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe 83 PID 4644 wrote to memory of 4380 4644 esS.exe 100 PID 4644 wrote to memory of 4380 4644 esS.exe 100 PID 4644 wrote to memory of 4380 4644 esS.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60433a5ba519475e6faa1a4f7210bc20.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\esS.exeC:\Users\Admin\AppData\Local\Temp\esS.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\102713c4.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:4380
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\102713c4.bat
- Size 181B
- SHA256 2cdb57e7868088d333b33efc5e3fb2729076e6af6129074737bbab62029930c2
- MD5 2894268bd2f6776869ee088cfce16a86
- SHA1 9a062b72aa5d65e14452de7260d645c07af22116
- SHA512 a447e04f443fa3a817d17e10c288658a525d7d402a34602bd264a145cae40026af3f007a6ce48f17886941721989fc31dd349bde41d1e568577a36858b8b9af7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\esS.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- MD5 SHA1 SHA512 SSDEEP