95a9a17a6ad84d41f79b34ef04214186f00364e189741cb8518cb7b8f89a97e8

General

Target

c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
Size

36KB
MD5

c7712f4dd8da310975c73e5b7056f8c7
SHA1

15e4c837ffc8db4da0a721b2967b65b692232b18
SHA256

95a9a17a6ad84d41f79b34ef04214186f00364e189741cb8518cb7b8f89a97e8
SHA512

49c6c38137086631a30101880302143c35d0eba2eee14430a6d02a7ede275c125ed14912495976060e3e6c7257714147d4a19995b0e2c0374d803dd558c81aac
SSDEEP

768:QATJxFQM1+Bw8JrV4UYW50z4C6AXTzM7WyjiTp:QA3cBw8JrydM7W7l

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2148	BCSSync.exe
2704	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2192	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
2192	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
2148	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2148 set thread context of 2704	2148	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync .exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2192	2180	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2148	2192	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2148	2192	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2148	2192	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2148	2192	c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2148 wrote to memory of 2704	2148	BCSSync.exe	32
PID 2704 wrote to memory of 2668	2704	BCSSync.exe	33
PID 2704 wrote to memory of 2668	2704	BCSSync.exe	33
PID 2704 wrote to memory of 2668	2704	BCSSync.exe	33
PID 2704 wrote to memory of 2668	2704	BCSSync.exe	33

C:\Users\Admin\AppData\Local\Temp\c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\c7712f4dd8da310975c73e5b7056f8c7_JaffaCakes118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
36KB

MD5
5043b30f58ba0197d29631783fea1ce7

SHA1
8e7bc9d2cad43019b431614573341dfcdb3729ed

SHA256
62a01f08d5caa2d1dd02d466ab407aaaa85e198045a440f9b4825be7b0005aa9

SHA512
db77a6d0104a79c4d6c0357f3bc810b146d8d74c4167c53523a641dbdd2d432c86631f54706dbb7d6a506f2d0c1b6fda86f853f12647244bb9d402ef16c043dd

Download Submit
memory/2192-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing