4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8

Analysis

max time kernel
143s
max time network
141s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
Size

110KB
MD5

6fb8cda68549a4507dfa74d69656d0f2
SHA1

69a979178a69da616dc3e40d68a3b5346eebb73a
SHA256

4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8
SHA512

92d8b778a9fb293b798860d60582b9aed4280e896a8732b5ac6290a9771f5d1b9561391baaa67e76c739d1d7bfd9d9284d614f8de48c1474d994088fa7a8463c
SSDEEP

1536:dTKdhmMFi+lokn0CcuQpuv0Ix0vkHWR8ceQDxeOv:dT8cUi20DuQpKnsMkrBv

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1552	BCSSync.exe
904	BCSSync.exe

Loads dropped DLL 2 IoCs

pid	Process
1600	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
1600	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 1552 set thread context of 904	1552	BCSSync.exe	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 2008 wrote to memory of 1600	2008	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	27
PID 1600 wrote to memory of 1552	1600	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	28
PID 1600 wrote to memory of 1552	1600	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	28
PID 1600 wrote to memory of 1552	1600	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	28
PID 1600 wrote to memory of 1552	1600	4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe	28
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 1552 wrote to memory of 904	1552	BCSSync.exe	29
PID 904 wrote to memory of 1684	904	BCSSync.exe	30
PID 904 wrote to memory of 1684	904	BCSSync.exe	30
PID 904 wrote to memory of 1684	904	BCSSync.exe	30
PID 904 wrote to memory of 1684	904	BCSSync.exe	30

C:\Users\Admin\AppData\Local\Temp\4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
"C:\Users\Admin\AppData\Local\Temp\4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
  "C:\Users\Admin\AppData\Local\Temp\4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\4a62dbe8d16a8bfc3da567f94de72a7d09bf7c44df3fc7e42d8304cfa4dc9be8.exe
        5⤵
        
        PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
110KB

MD5
bde660753d93d46de63089e938fdcfa9

SHA1
db444ebd5292376026c27c71e4066704478f5743

SHA256
303a0f6f2b0bb91eb4eb14599a1ed3b54bc1a7dbc15513912c3fc64bf560886d

SHA512
60826962d7e39d4f5019e4e961992f91ba77ea8b55fd71145eb34826662687feb62e2b8b4a4ec8c9f6ca5b5a62fdd6041c110f860f7e44edfa6960c19c47a020

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
110KB

MD5
bde660753d93d46de63089e938fdcfa9

SHA1
db444ebd5292376026c27c71e4066704478f5743

SHA256
303a0f6f2b0bb91eb4eb14599a1ed3b54bc1a7dbc15513912c3fc64bf560886d

SHA512
60826962d7e39d4f5019e4e961992f91ba77ea8b55fd71145eb34826662687feb62e2b8b4a4ec8c9f6ca5b5a62fdd6041c110f860f7e44edfa6960c19c47a020

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
110KB

MD5
bde660753d93d46de63089e938fdcfa9

SHA1
db444ebd5292376026c27c71e4066704478f5743

SHA256
303a0f6f2b0bb91eb4eb14599a1ed3b54bc1a7dbc15513912c3fc64bf560886d

SHA512
60826962d7e39d4f5019e4e961992f91ba77ea8b55fd71145eb34826662687feb62e2b8b4a4ec8c9f6ca5b5a62fdd6041c110f860f7e44edfa6960c19c47a020

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
110KB

MD5
bde660753d93d46de63089e938fdcfa9

SHA1
db444ebd5292376026c27c71e4066704478f5743

SHA256
303a0f6f2b0bb91eb4eb14599a1ed3b54bc1a7dbc15513912c3fc64bf560886d

SHA512
60826962d7e39d4f5019e4e961992f91ba77ea8b55fd71145eb34826662687feb62e2b8b4a4ec8c9f6ca5b5a62fdd6041c110f860f7e44edfa6960c19c47a020

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
110KB

MD5
bde660753d93d46de63089e938fdcfa9

SHA1
db444ebd5292376026c27c71e4066704478f5743

SHA256
303a0f6f2b0bb91eb4eb14599a1ed3b54bc1a7dbc15513912c3fc64bf560886d

SHA512
60826962d7e39d4f5019e4e961992f91ba77ea8b55fd71145eb34826662687feb62e2b8b4a4ec8c9f6ca5b5a62fdd6041c110f860f7e44edfa6960c19c47a020

Download Submit
memory/904-87-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/904-83-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-63-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1600-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-84-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1600-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download