bdaejec | 428d2b34a28bf672cfd60124fa1aa6aaf1ec0758002f6740b8732c2c637cf88a

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/01/2025, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe
Size

842KB
MD5

64ac756ae99eb21a7883d0e1b177aee0
SHA1

0ac236915744319a88f2497010630a63542fa192
SHA256

428d2b34a28bf672cfd60124fa1aa6aaf1ec0758002f6740b8732c2c637cf88a
SHA512

ade263a37769167978b7c1a7a8adfde12d57fe1008e032aaf40d57278c5158f81d1b358032244ac07717d7c29eb5f2a50b098863ae5ef94496d519a810a2d8f0
SSDEEP

12288:89QM1W4lbdag85peRKJ17aV6pWgzHrGhuvj/ZIW/fN9pz:sQMk4lbdatK61eoLz6QnHJ

Score

10^/10

bdaejec aspackv2 backdoor discovery upx

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral1/memory/2580-33-0x0000000000BE0000-0x0000000000BE9000-memory.dmp	family_bdaejec_backdoor

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00080000000120fd-7.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2580	yFLBR.exe

Loads dropped DLL 2 IoCs

pid	Process
2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe
2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2604-1-0x0000000000400000-0x00000000005E6000-memory.dmp	upx
behavioral1/memory/2604-35-0x0000000000400000-0x00000000005E6000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	yFLBR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	yFLBR.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	yFLBR.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	yFLBR.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	yFLBR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	yFLBR.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	yFLBR.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	yFLBR.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	yFLBR.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	yFLBR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	yFLBR.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	yFLBR.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE	yFLBR.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{0AC99519-0FE0-4797-A0D6-2C21B93D4350}\chrome_installer.exe	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE	yFLBR.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	yFLBR.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	yFLBR.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	yFLBR.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	yFLBR.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	yFLBR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yFLBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe
2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe
2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2580	2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe	29
PID 2604 wrote to memory of 2580	2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe	29
PID 2604 wrote to memory of 2580	2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe	29
PID 2604 wrote to memory of 2580	2604	JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe	29
PID 2580 wrote to memory of 448	2580	yFLBR.exe	31
PID 2580 wrote to memory of 448	2580	yFLBR.exe	31
PID 2580 wrote to memory of 448	2580	yFLBR.exe	31
PID 2580 wrote to memory of 448	2580	yFLBR.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ac756ae99eb21a7883d0e1b177aee0.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\yFLBR.exe
  C:\Users\Admin\AppData\Local\Temp\yFLBR.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\2dd62c30.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2dd62c30.bat

Filesize
185B

MD5
02a30c34a1b779b577611bbd48bec6ad

SHA1
5f3dd5cc038372fd95147dc216dc8ef09b5b14a7

SHA256
cbfd333bdc76fa2e0c85594107b8d9eaee683df95b2ed42e6cbe153d3bb273d2

SHA512
47245fc5dd7129cb70d276262507f9843d6daefab5d19054821667a12888d4853da24336af234487abc5171789fa55ba7608267bee8f9b3f9a7fb8c433b167f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\yFLBR.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\Desktop\desktop.ini

Filesize
282B

MD5
9e36cc3537ee9ee1e3b10fa4e761045b

SHA1
7726f55012e1e26cc762c9982e7c6c54ca7bb303

SHA256
4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

SHA512
5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

Download Submit
memory/2580-11-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

Filesize
36KB

Download
memory/2580-33-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

Filesize
36KB

Download
memory/2604-10-0x00000000003B0000-0x00000000003B9000-memory.dmp

Filesize
36KB

Download
memory/2604-14-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2604-9-0x00000000003B0000-0x00000000003B9000-memory.dmp

Filesize
36KB

Download
memory/2604-1-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2604-35-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2604-37-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2604-44-0x00000000003B0000-0x00000000003B9000-memory.dmp

Filesize
36KB

Download
memory/2604-45-0x00000000003B0000-0x00000000003B9000-memory.dmp

Filesize
36KB

Download