Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 18:41
Static task
static1
Behavioral task
behavioral1
Sample
0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe
-
Size
436KB
-
MD5
0d1fdbb23b827c1e984ef0f3039d360f
-
SHA1
39de26802d5014288c9601ef23d57f5102d6394e
-
SHA256
b63261716b1e781beb56b37cd2d44a9c336e7b420652aed09044fd43247a1b80
-
SHA512
3d3929f9aa3ec911a7860b2e573e364056af57ee8030ca59c056ed566356d45403b5c6ac3f0a5dd6bbae8670f051b628152ff2352ec3a019cc0b6d3446ffd27e
-
SSDEEP
6144:it6iTDWnUw3u/S/QUNQDpKmYZwrhvKnZoV7WImYKyn9hkUGIVCYT:eTDKzq8mBrhinK7WImYVvkYVTT
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
4c1105c5-1424-44dd-957a-16c597aebc44
-
activate_away_mode
true
-
backup_connection_host
tzitziklishop.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-25T10:29:14.834225736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
OCTOBER NEW
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
4c1105c5-1424-44dd-957a-16c597aebc44
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exedescription pid process target process PID 1692 set thread context of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DDP Service\ddpsv.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1732 schtasks.exe 2560 schtasks.exe 1332 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exeRegSvcs.exepid process 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe 2200 RegSvcs.exe 2200 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2200 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe Token: SeDebugPrivilege 2200 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 1692 wrote to memory of 2560 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe schtasks.exe PID 1692 wrote to memory of 2560 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe schtasks.exe PID 1692 wrote to memory of 2560 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe schtasks.exe PID 1692 wrote to memory of 2560 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe schtasks.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 1692 wrote to memory of 2200 1692 0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe RegSvcs.exe PID 2200 wrote to memory of 1332 2200 RegSvcs.exe schtasks.exe PID 2200 wrote to memory of 1332 2200 RegSvcs.exe schtasks.exe PID 2200 wrote to memory of 1332 2200 RegSvcs.exe schtasks.exe PID 2200 wrote to memory of 1332 2200 RegSvcs.exe schtasks.exe PID 2200 wrote to memory of 1732 2200 RegSvcs.exe schtasks.exe PID 2200 wrote to memory of 1732 2200 RegSvcs.exe schtasks.exe PID 2200 wrote to memory of 1732 2200 RegSvcs.exe schtasks.exe PID 2200 wrote to memory of 1732 2200 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d1fdbb23b827c1e984ef0f3039d360f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aIUwpPsBoLTV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1120.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1305.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1120.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp1305.tmpFilesize
1KB
MD593d357e6194c8eb8d0616a9f592cc4bf
SHA15cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA5124df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f
-
memory/1692-0-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/1692-2-0x0000000000630000-0x0000000000670000-memory.dmpFilesize
256KB
-
memory/1692-1-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/1692-3-0x0000000000630000-0x0000000000670000-memory.dmpFilesize
256KB
-
memory/1692-4-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/1692-5-0x0000000000630000-0x0000000000670000-memory.dmpFilesize
256KB
-
memory/1692-6-0x0000000000630000-0x0000000000670000-memory.dmpFilesize
256KB
-
memory/1692-26-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/2200-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2200-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2200-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2200-25-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2200-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2200-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2200-27-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/2200-28-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2200-29-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/2200-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2200-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2200-37-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2200-38-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2200-39-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/2200-40-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2200-41-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2200-42-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB