d7c7dd8faef29df6723e0069803292600145bb9fe74c809e189619a884f6d8f7

General

Target

dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
Size

39KB
MD5

dcc2278f45f34bff2e95e9a0d6d914df
SHA1

b207f2b06f35757cff6f6c37a1dae6d71685b74e
SHA256

d7c7dd8faef29df6723e0069803292600145bb9fe74c809e189619a884f6d8f7
SHA512

85bad03309064f028868ef1cc063f4460bbce82d4896a2f0071c3993be38958d3a13e975f76486d92438f13a947f823b8025eeeb17539a62cbc9e240d1b1f223
SSDEEP

768:40DNkaTpkcxgrFFh10xA2NDaiOkI8IfAyu69mKaj/tYaUB9oP:40DmaTpPgZFP0xAIOD8rwmKDah

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1928	BCSSync.exe
2596	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2976	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
2976	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
1928	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 1928 set thread context of 2596	1928	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\2T2k1S.com	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2976	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
1928	BCSSync.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2880 wrote to memory of 2976	2880	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	30
PID 2976 wrote to memory of 1928	2976	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	31
PID 2976 wrote to memory of 1928	2976	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	31
PID 2976 wrote to memory of 1928	2976	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	31
PID 2976 wrote to memory of 1928	2976	dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe	31
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 1928 wrote to memory of 2596	1928	BCSSync.exe	32
PID 2596 wrote to memory of 2448	2596	BCSSync.exe	33
PID 2596 wrote to memory of 2448	2596	BCSSync.exe	33
PID 2596 wrote to memory of 2448	2596	BCSSync.exe	33
PID 2596 wrote to memory of 2448	2596	BCSSync.exe	33

C:\Users\Admin\AppData\Local\Temp\dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\dcc2278f45f34bff2e95e9a0d6d914df_JaffaCakes118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
39KB

MD5
52f4a813e08ac11179d92e04f36dac4b

SHA1
51b0e7cc30000b19749d858385bc0c04dd2019b2

SHA256
6058c095e0f4e3784d72ed7f6f487ad9af00ff499569f0a1b542203109340ad4

SHA512
cfdc718c6445a5e096d1c7463c160b5af66ac8625e7d2b7b9dea21d56b5b82a4c2439343d649d9495416a8660480dcb0d8c3db34c1383b821d1974632f9b6a95

Download Submit
memory/2596-46-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-14-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing