5b9a8588b84dfc23d4a061951cfda02f32c838e1ec3b202e435460c5a1b13b98

General

Target

b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
Size

41KB
MD5

b96e6d561bbbe5bd89b97adc7ba2722a
SHA1

a73d5fc7afe70a7942b6a74faeab6896eab0e231
SHA256

5b9a8588b84dfc23d4a061951cfda02f32c838e1ec3b202e435460c5a1b13b98
SHA512

9c60694f04be66671a6c4b782564605ad40fbe0f5cce4a46b9afff5a66ab1e74b9474abc97c67ac5046f3855b095abf0d9711f2d694d53305f16e66113977026
SSDEEP

768:Bi6MbK0BYoGfqCZlySRO2woK/Z6YIhoFtQjXyEJvc8JzKZr12qhZhXn:cJWoYnqCjao/HzxCQzKZrYq5Xn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2836	BCSSync.exe
2976	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2096	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
2096	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
2836	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2864 set thread context of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2836 set thread context of 2976	2836	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\6Lal250SP.com	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync .exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2096	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
2836	BCSSync.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2096	2864	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	30
PID 2096 wrote to memory of 2836	2096	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	31
PID 2096 wrote to memory of 2836	2096	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	31
PID 2096 wrote to memory of 2836	2096	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	31
PID 2096 wrote to memory of 2836	2096	b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe	31
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2836 wrote to memory of 2976	2836	BCSSync.exe	32
PID 2976 wrote to memory of 2144	2976	BCSSync.exe	34
PID 2976 wrote to memory of 2144	2976	BCSSync.exe	34
PID 2976 wrote to memory of 2144	2976	BCSSync.exe	34
PID 2976 wrote to memory of 2144	2976	BCSSync.exe	34

C:\Users\Admin\AppData\Local\Temp\b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\b96e6d561bbbe5bd89b97adc7ba2722a_JaffaCakes118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
41KB

MD5
a0fc67d859bc7142b7a822c3f27c4e5a

SHA1
7895dfe024d82e2d436faefab76f457987900bc5

SHA256
9e69f5486b9c75b9e9397df2a268d08cffd8178bfe8ed1faea93204d12ca983a

SHA512
34f3ccf7b77b7b6d2d612208e621f6afa6bd963d93e9f83a5dd4810be26d141de0a27340153084d853474aa9c12cfa2ef58d1ed6e61dbe4c2350b125795c9695

Download Submit
memory/2096-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-14-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2976-46-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing