ac8dd1fc3c031e5efa5ef36ff27b18cf9dde07a8313cb40298905db7832c4690

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
Size

38KB
MD5

93aa69aedc35bfbb2ac4ecf6a5f4cce7
SHA1

aa147cea8c9156516cc77f720392f62cb1ba1d0c
SHA256

ac8dd1fc3c031e5efa5ef36ff27b18cf9dde07a8313cb40298905db7832c4690
SHA512

03b594fa2be36a6383a68079a117a48a87b78e5d5cfc33ae15f232096f93738dd9d123e09dd60d1cb1a4a3c94711c7a544b722941b4ec08e080aaac4498d7c6d
SSDEEP

768:cD8Mku/08vChRzSbJ/iB1ljyRFQPeB1Qi6YyJVQQeDlV8T3+cxcG5:ABkuM1hR2g18CeB1QMyJVQQeD4vxcG5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2392	BCSSync.exe
2708	BCSSync.exe
2352	Gb35ud2J.com
2500	Gb35ud2J.com

Loads dropped DLL 3 IoCs

pid	Process
2216	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
2216	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
2392	BCSSync.exe

Unexpected DNS network traffic destination 11 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Gb35ud2J.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2392 set thread context of 2708	2392	BCSSync.exe	33
PID 2352 set thread context of 2500	2352	Gb35ud2J.com	37

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Gb35ud2J.com	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gb35ud2J.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync .exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Gb35ud2J.com
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Gb35ud2J.com
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gb35ud2J.com
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Gb35ud2J.com
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Gb35ud2J.com
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gb35ud2J.com

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2216	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
2708	BCSSync.exe
2500	Gb35ud2J.com

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
2392	BCSSync.exe
2352	Gb35ud2J.com

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2216	2308	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2392	2216	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2392	2216	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2392	2216	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2392	2216	93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe	32
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2392 wrote to memory of 2708	2392	BCSSync.exe	33
PID 2708 wrote to memory of 2568	2708	BCSSync.exe	34
PID 2708 wrote to memory of 2568	2708	BCSSync.exe	34
PID 2708 wrote to memory of 2568	2708	BCSSync.exe	34
PID 2708 wrote to memory of 2568	2708	BCSSync.exe	34
PID 1956 wrote to memory of 2352	1956	taskeng.exe	36
PID 1956 wrote to memory of 2352	1956	taskeng.exe	36
PID 1956 wrote to memory of 2352	1956	taskeng.exe	36
PID 1956 wrote to memory of 2352	1956	taskeng.exe	36
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37
PID 2352 wrote to memory of 2500	2352	Gb35ud2J.com	37

C:\Users\Admin\AppData\Local\Temp\93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\93aa69aedc35bfbb2ac4ecf6a5f4cce7_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2568

C:\Windows\system32\taskeng.exe
taskeng.exe {A79FBAD7-6615-4BCB-9177-AAE8FD88B123} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\Fonts\Gb35ud2J.com
  C:\Windows\Fonts\Gb35ud2J.com
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\Fonts\Gb35ud2J.com
    C:\Windows\Fonts\Gb35ud2J.com
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
38KB

MD5
d69bc64a3f5f7b70818689ecc806f543

SHA1
7d6f8cdf4355e61345fd88d111efe5ef79e3a0ca

SHA256
8ff838d33e1d39f204ed4417b18ef886bd0a38ff60c169a456be5c010baa1d73

SHA512
fb468aa57602bb2698e747af640821720216f0823053e3bc2a18a71934fa22ad9e298e36d7b2787e9f75a2ea95c2b469d92834fbacef61b658d42bcfb94ac220

Download Submit
C:\Windows\Fonts\Gb35ud2J.com

Filesize
38KB

MD5
93aa69aedc35bfbb2ac4ecf6a5f4cce7

SHA1
aa147cea8c9156516cc77f720392f62cb1ba1d0c

SHA256
ac8dd1fc3c031e5efa5ef36ff27b18cf9dde07a8313cb40298905db7832c4690

SHA512
03b594fa2be36a6383a68079a117a48a87b78e5d5cfc33ae15f232096f93738dd9d123e09dd60d1cb1a4a3c94711c7a544b722941b4ec08e080aaac4498d7c6d

Download Submit
memory/2216-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2500-72-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2708-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2708-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download