87f95cf06cf4aca5be6bcf8e85ec2592611db73e32b703f6802b9679145f1f1a

General

Target

178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
Size

91KB
MD5

178ae9ec0d28ecbd42dec28de30376c5
SHA1

1d6ee629611b7e11fadb5153e214b9784cf9a950
SHA256

87f95cf06cf4aca5be6bcf8e85ec2592611db73e32b703f6802b9679145f1f1a
SHA512

c95e636fa0e1664a68fec663b14b296b5caa84788e9949627a3a51cb0f9ed7e155bb22edfea412ef819783d54fcc91d6348d1ebad628038f3a8c0b6573667df6
SSDEEP

1536:ZiDLG7z8p+SZjBHdEhIxBtS5Q5grdU3+kNS9Y/bmF6uIo6nX7mNeomBZzJ1J+B00:ZifEzyPHdEaaQ5g2Ow2Y/bmF65NCNeoR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2540	BCSSync.exe
2716	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
2128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
2540	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2540 set thread context of 2716	2540	BCSSync.exe	30

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2268 wrote to memory of 2128	2268	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2540	2128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2540	2128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2540	2128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2540	2128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	29
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2540 wrote to memory of 2716	2540	BCSSync.exe	30
PID 2716 wrote to memory of 2488	2716	BCSSync.exe	31
PID 2716 wrote to memory of 2488	2716	BCSSync.exe	31
PID 2716 wrote to memory of 2488	2716	BCSSync.exe	31
PID 2716 wrote to memory of 2488	2716	BCSSync.exe	31

C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
        5⤵
        
        PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
91KB

MD5
efcd2838a557b7231a638735565f9681

SHA1
bcc185546165f3d5c92a89093084a63be484c90c

SHA256
c84c64cb5874b9cd401159c69007afde9e9a63536da82c0d5cf98cf0c2350d19

SHA512
d0b3cb1eae50b041ce0ad80747d629784df1e38ceafabb4f1fbbc163ccd4cce0e723a3313fe21b1349e49489f191916c6e579feabc4e7f03f7f63f8051ef1bae

Download Submit
memory/2128-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2128-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2128-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2128-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2128-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2128-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2128-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2128-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2716-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2716-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing