Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
General
-
Target
JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe
-
Size
190KB
-
MD5
6b8ee41bb75e0139d47bad35224aec10
-
SHA1
478aabdd002031da79cd02d85f0966290ecff6fd
-
SHA256
a61cf1002336c73941cb01f6a8799ebcba940b42118dabcc2af443b930bd9e04
-
SHA512
6da833ecef7b1c5592866a7ba07206f5ea644cb19c10c2f0c25ad1aff279878a3cdc987033f4368e8a09d17957f920785f418e223c6675e618452d3789054899
-
SSDEEP
3072:lWNvj0PaGN8RWTLSQbqfJy4tfQ/ZaP0O1r2lmpDMzJDQGCH:lWN72rN2U5mk4to/I84DMf
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2532-16-0x0000000000FB0000-0x0000000000FB9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000b00000001225e-2.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2532 ltsLCG.exe -
Loads dropped DLL 2 IoCs
pid Process 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE ltsLCG.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE ltsLCG.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe ltsLCG.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE ltsLCG.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe ltsLCG.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE ltsLCG.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE ltsLCG.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0AC99519-0FE0-4797-A0D6-2C21B93D4350}\chrome_installer.exe ltsLCG.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe ltsLCG.exe File opened for modification C:\Program Files\7-Zip\7z.exe ltsLCG.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe ltsLCG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltsLCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2532 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 30 PID 2672 wrote to memory of 2532 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 30 PID 2672 wrote to memory of 2532 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 30 PID 2672 wrote to memory of 2532 2672 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 30 PID 2532 wrote to memory of 1976 2532 ltsLCG.exe 33 PID 2532 wrote to memory of 1976 2532 ltsLCG.exe 33 PID 2532 wrote to memory of 1976 2532 ltsLCG.exe 33 PID 2532 wrote to memory of 1976 2532 ltsLCG.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\ltsLCG.exeC:\Users\Admin\AppData\Local\Temp\ltsLCG.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\482a62d1.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5d1cffcb29e8fda9d6b7113d81aff9ffe
SHA11c84e04bfd8c537fa0906801639372976c666c5d
SHA2565a3a2bffdeb22fb829b9e7be377631f06ef4ccedf252c78ac950125275d699c5
SHA5129a12592b4d5045d70412576f64398e7e912a664d437d28404e13ef683074f3ff738157831c92989b93e82a18149d8c01eaf8647721e41cd1215ed21a22e1f253
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e