a576f21e1fde5054b53bd80bacff9ab20f1c8b510dd7f7a281d056bbfe5e912a

General

Target

5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
Size

36KB
MD5

5abbd71a1c316df37fc3cd9d0dd5d14f
SHA1

7f801e5e9b40acb68249b02f063f46813e7d1246
SHA256

a576f21e1fde5054b53bd80bacff9ab20f1c8b510dd7f7a281d056bbfe5e912a
SHA512

991d35856115b4c689d65e465fb327f0eec3cc9d29fb85f07a01c25da7ee04a45cd2ed077d206b4e0f9ebf7a274959d30de7e57ba4b829c688172b4c76dfd6a3
SSDEEP

768:QATJxFQM1+Bw8JrV4UYW50z4C6AXTzM7WyjiTp:QA3cBw8JrydM7W7l

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2916	BCSSync.exe
2840	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2640	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
2640	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
2916	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 2916 set thread context of 2840	2916	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2640	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2640	3060	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2916	2640	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2916	2640	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2916	2640	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2916	2640	5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2916 wrote to memory of 2840	2916	BCSSync.exe	32
PID 2840 wrote to memory of 2764	2840	BCSSync.exe	33
PID 2840 wrote to memory of 2764	2840	BCSSync.exe	33
PID 2840 wrote to memory of 2764	2840	BCSSync.exe	33
PID 2840 wrote to memory of 2764	2840	BCSSync.exe	33

C:\Users\Admin\AppData\Local\Temp\5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\5abbd71a1c316df37fc3cd9d0dd5d14f_JaffaCakes118.exe
        5⤵
        
        PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
36KB

MD5
bf8685ef4593363533cb9e3ee978d60c

SHA1
f05f524e5d4db77312744ebdc796c1195497ddf4

SHA256
e4bc296ca740552b4d1de3dd23efbb037221c80eb18bfde70b918b5b25ca94a9

SHA512
9039ec350947894c4accd5280d2491f87da51b94e5c8cece28e5ed2c7f9a86cab7676de2c8da4e38b9f857642013c83045d0a2ca95739b6db6319511d033f1d9

Download Submit
memory/2640-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2840-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing