46ad239521341607995d631c2edd4d149071bb4e3243a350b799453f7db3db66

General

Target

6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
Size

33KB
MD5

6116d7b6c499555813824aa3aec4da92
SHA1

ee80bea9d85389216fe89e05a95016145aa9b0ff
SHA256

46ad239521341607995d631c2edd4d149071bb4e3243a350b799453f7db3db66
SHA512

933f70841bb82b00bb9cdcb349fa23eaf24605855b50ad4f57377d678b51784e7c8ec02e78fefa4bdda0bd1e150b8ed9384e659c2134b2c8d3f757f21de99854
SSDEEP

768:7lIGpJ3bZy1SAP6Cb2ye/w4UbDN3jKgUjIjQ0+GtmZuAZonc:5xJLY1SAyQ2yGwRzhIGtvc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2804	BCSSync.exe
2984	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2160	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
2160	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
2804	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 2804 set thread context of 2984	2804	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2160	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
2804	BCSSync.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2160	3068	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2804	2160	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2804	2160	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2804	2160	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2804	2160	6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2804 wrote to memory of 2984	2804	BCSSync.exe	32
PID 2984 wrote to memory of 2956	2984	BCSSync.exe	33
PID 2984 wrote to memory of 2956	2984	BCSSync.exe	33
PID 2984 wrote to memory of 2956	2984	BCSSync.exe	33
PID 2984 wrote to memory of 2956	2984	BCSSync.exe	33

C:\Users\Admin\AppData\Local\Temp\6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2984
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\6116d7b6c499555813824aa3aec4da92_JaffaCakes118.exe
        5⤵
        
        PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
33KB

MD5
6fccbc1a4e63b65138caadaf2612d938

SHA1
7ec93454b9f1d2de824041a2647b7e2db1a21a39

SHA256
ddce67c08b9429fc7922c99165185698d72a6132904feb00effbacb6afd72336

SHA512
75d4e39189e78ee080915dc3202d3199469d88d160eaf9ea33aba8c53991d6d60b06101988ec2593b2f51f78d3c004f6000c31ec555e373c5c1bbe52843870f7

Download Submit
memory/2160-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2160-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing