Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
General
-
Target
JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe
-
Size
190KB
-
MD5
6b8ee41bb75e0139d47bad35224aec10
-
SHA1
478aabdd002031da79cd02d85f0966290ecff6fd
-
SHA256
a61cf1002336c73941cb01f6a8799ebcba940b42118dabcc2af443b930bd9e04
-
SHA512
6da833ecef7b1c5592866a7ba07206f5ea644cb19c10c2f0c25ad1aff279878a3cdc987033f4368e8a09d17957f920785f418e223c6675e618452d3789054899
-
SSDEEP
3072:lWNvj0PaGN8RWTLSQbqfJy4tfQ/ZaP0O1r2lmpDMzJDQGCH:lWN72rN2U5mk4to/I84DMf
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/372-8-0x00000000003E0000-0x00000000003E9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000d000000023b53-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation ltsLCG.exe -
Executes dropped EXE 1 IoCs
pid Process 372 ltsLCG.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe ltsLCG.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe ltsLCG.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE ltsLCG.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe ltsLCG.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ltsLCG.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe ltsLCG.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe ltsLCG.exe File opened for modification C:\Program Files\7-Zip\7z.exe ltsLCG.exe File opened for modification C:\Program Files\dotnet\dotnet.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe ltsLCG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe ltsLCG.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ltsLCG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe ltsLCG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe ltsLCG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe ltsLCG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltsLCG.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5088 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 5088 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5088 wrote to memory of 372 5088 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 82 PID 5088 wrote to memory of 372 5088 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 82 PID 5088 wrote to memory of 372 5088 JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe 82 PID 372 wrote to memory of 1672 372 ltsLCG.exe 93 PID 372 wrote to memory of 1672 372 ltsLCG.exe 93 PID 372 wrote to memory of 1672 372 ltsLCG.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b8ee41bb75e0139d47bad35224aec10.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\ltsLCG.exeC:\Users\Admin\AppData\Local\Temp\ltsLCG.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0fa90506.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD524e28125565fbef602e29fe84911f00d
SHA14b6e68af389a74ef3d2c988b52e08418d1060209
SHA256357cd3985a5e4a7aca9c888c33340dd51646d23b8a97258394180713defb6da9
SHA5124dca96894a37ef2013fb88ad3fb8d0718682937b218785bf961f24789a78e6a2c72856e26c6499af184b89ff4fbd19dce5c63e3e36f6b3ea41207c189f9e18ae
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e