Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 07:36
Static task
static1
Behavioral task
behavioral1
Sample
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe
Resource
win7-20240319-en
General
-
Target
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe
-
Size
495KB
-
MD5
1c64859d2a5e195b51b5c1d0b973b2f3
-
SHA1
733895a6df13037644634316b616f2ab1818960f
-
SHA256
c0ef6cc74722f234a5d8176116dd0df60c32ce0a2ae7a7b88cf9dffd94f7f1a1
-
SHA512
bc144fadf9f0b3a4ad6092693935b4ef2063a3f9fb429cc33d69b54db65872540065c323e64021b09107babaabb9057a9276cfbb897ddef2cedbd7ea3353762c
-
SSDEEP
6144:HpMkhB95wk7Rv6kmfU8G64BFn90NNltKMcDWpOFFKJyHwU20VM0uLd2lYB:HSSB3dRnkU8G64H9iAaMFeUT/9a
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.75:97
75237636-ccfc-402a-827d-5ad01371659e
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-24T01:53:34.394429836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
97
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
75237636-ccfc-402a-827d-5ad01371659e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.75
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exedescription pid process target process PID 2284 set thread context of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2404 schtasks.exe 1692 schtasks.exe 1600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exepowershell.exeRegSvcs.exepid process 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe 2848 powershell.exe 2436 RegSvcs.exe 2436 RegSvcs.exe 2436 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2436 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 2436 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 2284 wrote to memory of 2848 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe powershell.exe PID 2284 wrote to memory of 2848 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe powershell.exe PID 2284 wrote to memory of 2848 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe powershell.exe PID 2284 wrote to memory of 2848 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe powershell.exe PID 2284 wrote to memory of 2404 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe schtasks.exe PID 2284 wrote to memory of 2404 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe schtasks.exe PID 2284 wrote to memory of 2404 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe schtasks.exe PID 2284 wrote to memory of 2404 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe schtasks.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2284 wrote to memory of 2436 2284 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2436 wrote to memory of 1692 2436 RegSvcs.exe schtasks.exe PID 2436 wrote to memory of 1692 2436 RegSvcs.exe schtasks.exe PID 2436 wrote to memory of 1692 2436 RegSvcs.exe schtasks.exe PID 2436 wrote to memory of 1692 2436 RegSvcs.exe schtasks.exe PID 2436 wrote to memory of 1600 2436 RegSvcs.exe schtasks.exe PID 2436 wrote to memory of 1600 2436 RegSvcs.exe schtasks.exe PID 2436 wrote to memory of 1600 2436 RegSvcs.exe schtasks.exe PID 2436 wrote to memory of 1600 2436 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sdEKmbTTxgFtdd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF3F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF547.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF92F.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF547.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmpF92F.tmpFilesize
1KB
MD52f26d92c1eeead3896820e56ec46f6f1
SHA1d95533b61eed7d89e4ada56bc566d60e42ac1f61
SHA25699a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa
SHA5126c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892
-
memory/2284-0-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2284-1-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2284-2-0x00000000004D0000-0x0000000000510000-memory.dmpFilesize
256KB
-
memory/2284-3-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2284-4-0x00000000004D0000-0x0000000000510000-memory.dmpFilesize
256KB
-
memory/2284-5-0x00000000004D0000-0x0000000000510000-memory.dmpFilesize
256KB
-
memory/2284-27-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2436-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2436-41-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/2436-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2436-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2436-25-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2436-26-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/2436-28-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2436-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2436-45-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/2436-44-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2436-43-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/2436-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2436-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2436-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2848-42-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2848-36-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/2848-35-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2848-33-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB