477cc9e2f60a66872f5bae9d03d01d63bca4e31ad111af4c2abe17aa5fe04c0c

General

Target

f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
Size

45KB
MD5

f5b33469af85cf10776322b32b552d15
SHA1

dce6d408a741d70ffb09c873a2f45fb115abfe8b
SHA256

477cc9e2f60a66872f5bae9d03d01d63bca4e31ad111af4c2abe17aa5fe04c0c
SHA512

4f81a13eb1e0afd33f3750766ddabd8ff3677f3b758aa16b822bb41fb281abac5f684608fb71e138706bfcc44eac059e510ea2d6ba32386fa22fe5073e1bbc09
SSDEEP

768:X323i/5MqKWo+CBe0dyvumWGpgIZ/jjPFjwUMaJiApGHNb6mBE:Ii/5MtWo+C80UcGpR/jjPpaSiApGtWsE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2732	BCSSync.exe
2576	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2384	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
2384	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
2732	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2732 set thread context of 2576	2732	BCSSync.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\l8mTbQx6.com	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2384	2840	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2732	2384	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2732	2384	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2732	2384	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2732	2384	f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2732 wrote to memory of 2576	2732	BCSSync.exe	32
PID 2576 wrote to memory of 2908	2576	BCSSync.exe	33
PID 2576 wrote to memory of 2908	2576	BCSSync.exe	33
PID 2576 wrote to memory of 2908	2576	BCSSync.exe	33
PID 2576 wrote to memory of 2908	2576	BCSSync.exe	33

C:\Users\Admin\AppData\Local\Temp\f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\f5b33469af85cf10776322b32b552d15_JaffaCakes118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
45KB

MD5
dc6e83a4d19de1fde586c675fd9725db

SHA1
960e41cee32a949203f61f5468dfa5129c3a30c0

SHA256
a6a8f4e258d52dc79c5fae5a75bd92ebbf536ac336ef15df46a20b2cc6a67709

SHA512
50edaed84d36ddbcba3c385ddf417d2908e91b50478f86695d8aea05e1bb70809610dfa9b05c618654863d2a54b3e2399128cd937a6962103befe472c8d78242

Download Submit
memory/2384-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-14-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2384-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2576-46-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing