142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2

General

Target

142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
Size

40KB
MD5

a90ac281e572aab1ca34c988c1c2b221
SHA1

9134967349366d9c7378890ac38119d7f48e53e3
SHA256

142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2
SHA512

668179f3479cf934465781a9b44c4a375a9f5923a8d84fd1108fdd5eadb952b8dec3165d795a7b3962ec5ec576008a5ee03aed1ebb26396d0c16ef8d205b96f9
SSDEEP

768:7F2Oi5T0xlRPeVI918IBqns8XCM1N2+HLCCRNg0VrvmP2Ys2clsIX2:7FqmJPsy8IBHB42+rE0VruPBtcRm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1416	BCSSync.exe
1364	BCSSync.exe

Loads dropped DLL 2 IoCs

pid	Process
2000	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
2000	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1416 set thread context of 1364	1416	BCSSync.exe	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\6mSHBnGJY.com	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1364	BCSSync.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
1416	BCSSync.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 1688 wrote to memory of 2000	1688	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	27
PID 2000 wrote to memory of 1416	2000	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	28
PID 2000 wrote to memory of 1416	2000	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	28
PID 2000 wrote to memory of 1416	2000	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	28
PID 2000 wrote to memory of 1416	2000	142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe	28
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1416 wrote to memory of 1364	1416	BCSSync.exe	29
PID 1364 wrote to memory of 564	1364	BCSSync.exe	30
PID 1364 wrote to memory of 564	1364	BCSSync.exe	30
PID 1364 wrote to memory of 564	1364	BCSSync.exe	30
PID 1364 wrote to memory of 564	1364	BCSSync.exe	30

C:\Users\Admin\AppData\Local\Temp\142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
"C:\Users\Admin\AppData\Local\Temp\142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
  "C:\Users\Admin\AppData\Local\Temp\142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\142d3db5357b0b20e5798de1763923bba401a59ce95a8d399f37a64281b1c3d2.exe
        5⤵
        
        PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
40KB

MD5
2a9aac76f132b6a853603e530e17ed34

SHA1
8890d8e617e03e21d5afc9799b677654518aac98

SHA256
ebe9526cd0c9f7d5a3d8941c31feb71e5c929833a7685b48facb04125ccc2ba5

SHA512
78bd81b264e1ec836ea7d1eca3ee80262c883fedc7317d03c6ed2bbfb6f111ee272af1bd0d06576c03ea2f4eeb7517403c4581ae2e02504bf8747cc7bcc871e4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
40KB

MD5
2a9aac76f132b6a853603e530e17ed34

SHA1
8890d8e617e03e21d5afc9799b677654518aac98

SHA256
ebe9526cd0c9f7d5a3d8941c31feb71e5c929833a7685b48facb04125ccc2ba5

SHA512
78bd81b264e1ec836ea7d1eca3ee80262c883fedc7317d03c6ed2bbfb6f111ee272af1bd0d06576c03ea2f4eeb7517403c4581ae2e02504bf8747cc7bcc871e4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
40KB

MD5
2a9aac76f132b6a853603e530e17ed34

SHA1
8890d8e617e03e21d5afc9799b677654518aac98

SHA256
ebe9526cd0c9f7d5a3d8941c31feb71e5c929833a7685b48facb04125ccc2ba5

SHA512
78bd81b264e1ec836ea7d1eca3ee80262c883fedc7317d03c6ed2bbfb6f111ee272af1bd0d06576c03ea2f4eeb7517403c4581ae2e02504bf8747cc7bcc871e4

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
40KB

MD5
2a9aac76f132b6a853603e530e17ed34

SHA1
8890d8e617e03e21d5afc9799b677654518aac98

SHA256
ebe9526cd0c9f7d5a3d8941c31feb71e5c929833a7685b48facb04125ccc2ba5

SHA512
78bd81b264e1ec836ea7d1eca3ee80262c883fedc7317d03c6ed2bbfb6f111ee272af1bd0d06576c03ea2f4eeb7517403c4581ae2e02504bf8747cc7bcc871e4

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
40KB

MD5
2a9aac76f132b6a853603e530e17ed34

SHA1
8890d8e617e03e21d5afc9799b677654518aac98

SHA256
ebe9526cd0c9f7d5a3d8941c31feb71e5c929833a7685b48facb04125ccc2ba5

SHA512
78bd81b264e1ec836ea7d1eca3ee80262c883fedc7317d03c6ed2bbfb6f111ee272af1bd0d06576c03ea2f4eeb7517403c4581ae2e02504bf8747cc7bcc871e4

Download Submit
memory/1364-91-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-65-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2000-64-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/2000-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2000-94-0x0000000073DA1000-0x0000000073DA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing