Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
-
Size
128KB
-
MD5
1b80613ac090d4eecfdd6554d4290b7b
-
SHA1
52ee1d680eb6394897e5854027f2eadc76acba2e
-
SHA256
f7f8376c3a4289f5ba02262cad0889c8f8572b0dac37226e37e71132a20ed825
-
SHA512
c2399e167628b579addfea8250ea63475f70bafc51c2bca4d0bc4fe2d82e7623ac008e1121f805a3a082ca8d4db4286450cfe61abc7d7f43cb1c84a0bf834d95
-
SSDEEP
3072:5zrl/nonoroxGDi73tCg3qilL42wA52jOMkrc0:5zrl/nonoroxGDFg3qilL42IjOPrD
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2636 BCSSync.exe 2544 BCSSync.exe -
Loads dropped DLL 2 IoCs
pid Process 2220 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 2220 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe -
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2204 set thread context of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2636 set thread context of 2544 2636 BCSSync.exe 30 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2220 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 2544 BCSSync.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2204 wrote to memory of 2220 2204 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 28 PID 2220 wrote to memory of 2636 2220 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 29 PID 2220 wrote to memory of 2636 2220 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 29 PID 2220 wrote to memory of 2636 2220 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 29 PID 2220 wrote to memory of 2636 2220 1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe 29 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2636 wrote to memory of 2544 2636 BCSSync.exe 30 PID 2544 wrote to memory of 2468 2544 BCSSync.exe 31 PID 2544 wrote to memory of 2468 2544 BCSSync.exe 31 PID 2544 wrote to memory of 2468 2544 BCSSync.exe 31 PID 2544 wrote to memory of 2468 2544 BCSSync.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe5⤵PID:2468
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD53148aa6dcd76cdb640a2defe483231a7
SHA130ec10387d43eaaeebc81b71a3a375c3f863ca48
SHA2567c872dbe25b959fed38a4b35afea0d6aae9f5fc5c89072c093d22750fb938e62
SHA512366819cf6c566c4973be00cf63bee6566f96f156d7dcfa195b2766cbde8b5f90f1a2bb986b9c605088ef2189c9f9445359883257eae1af07ce959e36e5f7386d