a48b369e5dd11734ed08c9e98e7501d24ed88993a4a4d4844457171e1c02a8de

General

Target

2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
Size

37KB
MD5

2e553d6d19fe7b18c54dccf130caf5dd
SHA1

fef96d69409116d5193dbe8aa9be234b8273401b
SHA256

a48b369e5dd11734ed08c9e98e7501d24ed88993a4a4d4844457171e1c02a8de
SHA512

2bbb33ec0ae74a2fca8ba4f530bc7d1c0294ca0ebf0060664ad8480b2dfdaf5eeb4973f77bc6058d74c5d2cba51d12000edf27391b72d178761ee46698e10b2b
SSDEEP

768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMy5:edILlknNU4rOobbLyn5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2764	BCSSync.exe
2828	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2640	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
2640	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
2764	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2764 set thread context of 2828	2764	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2640	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2640	2644	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2764	2640	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2764	2640	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2764	2640	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2764	2640	2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2764 wrote to memory of 2828	2764	BCSSync.exe	32
PID 2828 wrote to memory of 2572	2828	BCSSync.exe	33
PID 2828 wrote to memory of 2572	2828	BCSSync.exe	33
PID 2828 wrote to memory of 2572	2828	BCSSync.exe	33
PID 2828 wrote to memory of 2572	2828	BCSSync.exe	33

C:\Users\Admin\AppData\Local\Temp\2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\2e553d6d19fe7b18c54dccf130caf5dd_JaffaCakes118.exe
        5⤵
        
        PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
37KB

MD5
ef84cdeb7b63b0ccd7ee0322750b5552

SHA1
64a9cbda548ab329623285549e03478423879549

SHA256
81647393b1f082b55d2c0db8071921ba346f32159e62cdc20d7c145ba3e408ae

SHA512
c77e9a5f88b9a50dd0e0bbef98971d590d2e5c483d8c47e3660c4e62151e3f756ac9f20648c2b7a24c839297321de92d8494b0253ecd8d74f31463d02c40f627

Download Submit
memory/2640-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2828-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing