15ddc2427bb2e867e366ae404c24390cd7f87127f80830b40bd8b0e222eac14f

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
Size

42KB
MD5

4dbc4b094b789d8f0cfe48e552b2ac9f
SHA1

984ca133b1db7ce3b24bb31fed5c84ed43c59926
SHA256

15ddc2427bb2e867e366ae404c24390cd7f87127f80830b40bd8b0e222eac14f
SHA512

1665acbd0bbffede5c15d2c540548afcda032125529d57c2c1ea040ab895c66b732b08cb810521f3871cb39ee8bc5d813393c489e3d856e68a6d5449732d555a
SSDEEP

768:36Esy4oMuVJ9UFAp5v32pk9M7dZOJZBCN2T328Ro9H/auPl6eQPF0WABg:psH8OFA7K7dya2G4o9RP6PFbX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2568	BCSSync.exe
1792	BCSSync.exe
2556	f54M1v.com
1448	f54M1v.com
1972	BCSSync.exe
1608	BCSSync.exe

Loads dropped DLL 5 IoCs

pid	Process
824	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
824	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
2568	BCSSync.exe
1448	f54M1v.com
1448	f54M1v.com

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	f54M1v.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2568 set thread context of 1792	2568	BCSSync.exe	30
PID 2556 set thread context of 1448	2556	f54M1v.com	36
PID 1972 set thread context of 1608	1972	BCSSync.exe	38

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	f54M1v.com
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	f54M1v.com
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\f54M1v.com	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	f54M1v.com
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	f54M1v.com
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f54M1v.com
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	f54M1v.com
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f54M1v.com
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	f54M1v.com
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	BCSSync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	BCSSync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	BCSSync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	f54M1v.com
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	f54M1v.com
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c0ff629d63d7da01	BCSSync.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	BCSSync.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	f54M1v.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
824	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
1448	f54M1v.com

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 2292 wrote to memory of 824	2292	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	28
PID 824 wrote to memory of 2568	824	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	29
PID 824 wrote to memory of 2568	824	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	29
PID 824 wrote to memory of 2568	824	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	29
PID 824 wrote to memory of 2568	824	4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe	29
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 2568 wrote to memory of 1792	2568	BCSSync.exe	30
PID 1792 wrote to memory of 2456	1792	BCSSync.exe	33
PID 1792 wrote to memory of 2456	1792	BCSSync.exe	33
PID 1792 wrote to memory of 2456	1792	BCSSync.exe	33
PID 1792 wrote to memory of 2456	1792	BCSSync.exe	33
PID 560 wrote to memory of 2556	560	taskeng.exe	35
PID 560 wrote to memory of 2556	560	taskeng.exe	35
PID 560 wrote to memory of 2556	560	taskeng.exe	35
PID 560 wrote to memory of 2556	560	taskeng.exe	35
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 2556 wrote to memory of 1448	2556	f54M1v.com	36
PID 1448 wrote to memory of 1972	1448	f54M1v.com	37
PID 1448 wrote to memory of 1972	1448	f54M1v.com	37
PID 1448 wrote to memory of 1972	1448	f54M1v.com	37
PID 1448 wrote to memory of 1972	1448	f54M1v.com	37
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1972 wrote to memory of 1608	1972	BCSSync.exe	38
PID 1608 wrote to memory of 2072	1608	BCSSync.exe	39
PID 1608 wrote to memory of 2072	1608	BCSSync.exe	39
PID 1608 wrote to memory of 2072	1608	BCSSync.exe	39
PID 1608 wrote to memory of 2072	1608	BCSSync.exe	39

C:\Users\Admin\AppData\Local\Temp\4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\4dbc4b094b789d8f0cfe48e552b2ac9f_JaffaCakes118.exe
        5⤵
        
        PID:2456

C:\Windows\system32\taskeng.exe
taskeng.exe {F63A2B75-FDC6-42C2-A892-9E7D74203D5D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\Fonts\f54M1v.com
  C:\Windows\Fonts\f54M1v.com
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\Fonts\f54M1v.com
    C:\Windows\Fonts\f54M1v.com
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Windows\Fonts\f54M1v.com
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1972
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Windows\Fonts\f54M1v.com
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:1608
      - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Windows\Fonts\f54M1v.com
        6⤵
        
        PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\f54M1v.com

Filesize
42KB

MD5
4dbc4b094b789d8f0cfe48e552b2ac9f

SHA1
984ca133b1db7ce3b24bb31fed5c84ed43c59926

SHA256
15ddc2427bb2e867e366ae404c24390cd7f87127f80830b40bd8b0e222eac14f

SHA512
1665acbd0bbffede5c15d2c540548afcda032125529d57c2c1ea040ab895c66b732b08cb810521f3871cb39ee8bc5d813393c489e3d856e68a6d5449732d555a

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
42KB

MD5
8b4b76153091101657f35f4046cc29aa

SHA1
a9175bde0ba221f3a40691817a4aacb5a72f9968

SHA256
1980d104518278f4d022d5f573e16c48a0ebdc49065bd0cf4888346ee26d6109

SHA512
b980ee10b4a02e4c82dec6e03d054d3197fc3c14a1d388ff6dae55f4932335751f7a9b4f848412845c6ecba337869f84876d7c659a16609ea85ad92d644c1c53

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
42KB

MD5
721bc53e3bff8bdd944f40a5b0319fee

SHA1
b0543645c2b75ac2f381dd8ace067d92ad21a329

SHA256
7889adab3da5bfe97559e64de72c305b51993f4e09da873c53f9da09fcadec06

SHA512
ad8bf1a189ab265c0f19bc7bc377753ff61dabf659ebb262aa78399811e28f2990b792e53ad45b3f519d1b80db4c64350fe46782961739f1121846128217ecb5

Download Submit
memory/824-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-14-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/824-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1792-50-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download