831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81

Analysis

max time kernel
160s
max time network
207s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
Size

71KB
MD5

ff0ce7f9ce4f7d29b61d1c9c21438609
SHA1

37e5c230571f12f774b2f584a4741967c615d6de
SHA256

831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81
SHA512

18f8e0c82904551c3040ecafea7ad4a1acae2a1e8075a27642a950b248287b863d61f69a7b13cfa9cad13f394d65c5859484b15c7940c171b04844b3737d412a
SSDEEP

1536:KKMonowh4ostPr2/kBmkWbpab+CtuMFxdWOo6CLvjs8wBjnv:Knonoros9Pkbpe+zOo6EwBjnv

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
468	BCSSync.exe
1676	BCSSync.exe

Loads dropped DLL 2 IoCs

pid	Process
1684	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
1684	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1376 set thread context of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 468 set thread context of 1676	468	BCSSync.exe	30

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
1676	BCSSync.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1376 wrote to memory of 1684	1376	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	28
PID 1684 wrote to memory of 468	1684	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	29
PID 1684 wrote to memory of 468	1684	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	29
PID 1684 wrote to memory of 468	1684	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	29
PID 1684 wrote to memory of 468	1684	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	29
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 468 wrote to memory of 1676	468	BCSSync.exe	30
PID 1676 wrote to memory of 1060	1676	BCSSync.exe	31
PID 1676 wrote to memory of 1060	1676	BCSSync.exe	31
PID 1676 wrote to memory of 1060	1676	BCSSync.exe	31
PID 1676 wrote to memory of 1060	1676	BCSSync.exe	31

C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
"C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
  "C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
        5⤵
        
        PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
71KB

MD5
a7ac4153781d2b350ad696d03db856f5

SHA1
ba1ae661c25964cdaeae0930aad6e15743810a26

SHA256
cd77e1bdb8f2d88b65b4a438e8797c093da42f2bb276e0412d986dfdc883e33d

SHA512
5f285d2e8c990803969f958bb59146e8c0637e50cfb16071276554885ce976e127595ce6b129373d4efa91d0da44223d976b2b3a241eecc9029ccfdfb2126b0f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
71KB

MD5
a7ac4153781d2b350ad696d03db856f5

SHA1
ba1ae661c25964cdaeae0930aad6e15743810a26

SHA256
cd77e1bdb8f2d88b65b4a438e8797c093da42f2bb276e0412d986dfdc883e33d

SHA512
5f285d2e8c990803969f958bb59146e8c0637e50cfb16071276554885ce976e127595ce6b129373d4efa91d0da44223d976b2b3a241eecc9029ccfdfb2126b0f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
71KB

MD5
a7ac4153781d2b350ad696d03db856f5

SHA1
ba1ae661c25964cdaeae0930aad6e15743810a26

SHA256
cd77e1bdb8f2d88b65b4a438e8797c093da42f2bb276e0412d986dfdc883e33d

SHA512
5f285d2e8c990803969f958bb59146e8c0637e50cfb16071276554885ce976e127595ce6b129373d4efa91d0da44223d976b2b3a241eecc9029ccfdfb2126b0f

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
71KB

MD5
a7ac4153781d2b350ad696d03db856f5

SHA1
ba1ae661c25964cdaeae0930aad6e15743810a26

SHA256
cd77e1bdb8f2d88b65b4a438e8797c093da42f2bb276e0412d986dfdc883e33d

SHA512
5f285d2e8c990803969f958bb59146e8c0637e50cfb16071276554885ce976e127595ce6b129373d4efa91d0da44223d976b2b3a241eecc9029ccfdfb2126b0f

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
71KB

MD5
a7ac4153781d2b350ad696d03db856f5

SHA1
ba1ae661c25964cdaeae0930aad6e15743810a26

SHA256
cd77e1bdb8f2d88b65b4a438e8797c093da42f2bb276e0412d986dfdc883e33d

SHA512
5f285d2e8c990803969f958bb59146e8c0637e50cfb16071276554885ce976e127595ce6b129373d4efa91d0da44223d976b2b3a241eecc9029ccfdfb2126b0f

Download Submit
memory/1676-84-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1676-87-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-82-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-63-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1684-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download