fecfc56933af7f7d5d0c9083988d3c4debb494fee3bfbd69618a113985e32334

General

Target

d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
Size

36KB
MD5

d35ebb32f342b99664e2a94d6399f739
SHA1

cc8991de00f7b23c6ad71510efe607cc105a3473
SHA256

fecfc56933af7f7d5d0c9083988d3c4debb494fee3bfbd69618a113985e32334
SHA512

ce99a9f19e47aec40c6679b05cebd9ce9ad4fde1f98a3c248ce7b5d996e9b4d1c54b957d70589526b163a87dc9b0f8eb281c9d4e94efd0e459e0094d7ae5c467
SSDEEP

768:QATJxFQM1+Bw8JrV4UYW50z4C6AXTzM7WyjiTn:QA3cBw8JrydM7W77

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2976	BCSSync.exe
2712	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
1156	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
1156	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
2976	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 2976 set thread context of 2712	2976	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync .exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1156	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1464 wrote to memory of 1156	1464	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	30
PID 1156 wrote to memory of 2976	1156	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	31
PID 1156 wrote to memory of 2976	1156	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	31
PID 1156 wrote to memory of 2976	1156	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	31
PID 1156 wrote to memory of 2976	1156	d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe	31
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2976 wrote to memory of 2712	2976	BCSSync.exe	32
PID 2712 wrote to memory of 2700	2712	BCSSync.exe	33
PID 2712 wrote to memory of 2700	2712	BCSSync.exe	33
PID 2712 wrote to memory of 2700	2712	BCSSync.exe	33
PID 2712 wrote to memory of 2700	2712	BCSSync.exe	33

C:\Users\Admin\AppData\Local\Temp\d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\d35ebb32f342b99664e2a94d6399f739_JaffaCakes118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
36KB

MD5
2142989b63123e39dcf04ed2a544ac3c

SHA1
92d32224cb03fcfd40ad31bf5e2ba5326dc03e61

SHA256
9b86a785234e98aa9b834b9e7357145ec36fbfadec89e67f3d5eea23bb74c9a6

SHA512
6c24cff11549281d26356a5b49ae091f253026fc8058b796bad3752a48672688eb23af92a814e00089aa427b3dfd1551a142e4282d7563df5862cbad70ca80c5

Download Submit
memory/1156-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1156-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2712-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2712-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing