Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 07:36
Static task
static1
Behavioral task
behavioral1
Sample
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe
Resource
win7-20240319-en
General
-
Target
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe
-
Size
495KB
-
MD5
1c64859d2a5e195b51b5c1d0b973b2f3
-
SHA1
733895a6df13037644634316b616f2ab1818960f
-
SHA256
c0ef6cc74722f234a5d8176116dd0df60c32ce0a2ae7a7b88cf9dffd94f7f1a1
-
SHA512
bc144fadf9f0b3a4ad6092693935b4ef2063a3f9fb429cc33d69b54db65872540065c323e64021b09107babaabb9057a9276cfbb897ddef2cedbd7ea3353762c
-
SSDEEP
6144:HpMkhB95wk7Rv6kmfU8G64BFn90NNltKMcDWpOFFKJyHwU20VM0uLd2lYB:HSSB3dRnkU8G64H9iAaMFeUT/9a
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.75:97
75237636-ccfc-402a-827d-5ad01371659e
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-24T01:53:34.394429836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
97
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
75237636-ccfc-402a-827d-5ad01371659e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.75
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Service = "C:\\Program Files (x86)\\WAN Service\\wansvc.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exedescription pid process target process PID 3644 set thread context of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\WAN Service\wansvc.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\WAN Service\wansvc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 3376 schtasks.exe 3124 schtasks.exe 4884 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exepowershell.exeRegSvcs.exepid process 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe 1696 powershell.exe 1696 powershell.exe 2568 RegSvcs.exe 2568 RegSvcs.exe 2568 RegSvcs.exe 2568 RegSvcs.exe 1696 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2568 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe Token: SeDebugPrivilege 1696 powershell.exe Token: SeDebugPrivilege 2568 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 3644 wrote to memory of 1696 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe powershell.exe PID 3644 wrote to memory of 1696 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe powershell.exe PID 3644 wrote to memory of 1696 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe powershell.exe PID 3644 wrote to memory of 4884 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe schtasks.exe PID 3644 wrote to memory of 4884 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe schtasks.exe PID 3644 wrote to memory of 4884 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe schtasks.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 3644 wrote to memory of 2568 3644 1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe RegSvcs.exe PID 2568 wrote to memory of 3376 2568 RegSvcs.exe schtasks.exe PID 2568 wrote to memory of 3376 2568 RegSvcs.exe schtasks.exe PID 2568 wrote to memory of 3376 2568 RegSvcs.exe schtasks.exe PID 2568 wrote to memory of 3124 2568 RegSvcs.exe schtasks.exe PID 2568 wrote to memory of 3124 2568 RegSvcs.exe schtasks.exe PID 2568 wrote to memory of 3124 2568 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1c64859d2a5e195b51b5c1d0b973b2f3_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sdEKmbTTxgFtdd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFCEE.tmp"2⤵
- Creates scheduled task(s)
PID:4884 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFF5F.tmp"3⤵
- Creates scheduled task(s)
PID:3376 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1A2.tmp"3⤵
- Creates scheduled task(s)
PID:3124
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1300 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:81⤵PID:4108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jeqdxp4v.2kr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp1A2.tmpFilesize
1KB
MD59f0deb7cf87b4ae4efde9cc98ff481db
SHA1760265641ce176e555c64bedb494f6f75fd0bd27
SHA256a57110ccf892c8ca9c9b28b2608f4d37a8b5df1bfcf1411e7c62b500e82fabda
SHA5126517829d9a09df437a340485bb87183c7a80135a76296308120e0ab385f5ffa7369a2ace9655ffaf1c594869cc6a20015520b6b0c681217b641b3c58127a29de
-
C:\Users\Admin\AppData\Local\Temp\tmpFF5F.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
memory/1696-40-0x0000000006420000-0x0000000006774000-memory.dmpFilesize
3.3MB
-
memory/1696-16-0x0000000002F50000-0x0000000002F86000-memory.dmpFilesize
216KB
-
memory/1696-70-0x0000000071FF0000-0x00000000727A0000-memory.dmpFilesize
7.7MB
-
memory/1696-42-0x0000000006860000-0x000000000687E000-memory.dmpFilesize
120KB
-
memory/1696-67-0x0000000007EA0000-0x0000000007EA8000-memory.dmpFilesize
32KB
-
memory/1696-44-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/1696-66-0x0000000007EC0000-0x0000000007EDA000-memory.dmpFilesize
104KB
-
memory/1696-43-0x00000000068B0000-0x00000000068FC000-memory.dmpFilesize
304KB
-
memory/1696-19-0x0000000071FF0000-0x00000000727A0000-memory.dmpFilesize
7.7MB
-
memory/1696-22-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/1696-23-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/1696-21-0x0000000005CF0000-0x0000000006318000-memory.dmpFilesize
6.2MB
-
memory/1696-65-0x0000000007DC0000-0x0000000007DD4000-memory.dmpFilesize
80KB
-
memory/1696-27-0x00000000058B0000-0x00000000058D2000-memory.dmpFilesize
136KB
-
memory/1696-28-0x0000000005B80000-0x0000000005BE6000-memory.dmpFilesize
408KB
-
memory/1696-29-0x0000000005BF0000-0x0000000005C56000-memory.dmpFilesize
408KB
-
memory/1696-64-0x0000000007DB0000-0x0000000007DBE000-memory.dmpFilesize
56KB
-
memory/1696-63-0x0000000007D80000-0x0000000007D91000-memory.dmpFilesize
68KB
-
memory/1696-62-0x0000000007E00000-0x0000000007E96000-memory.dmpFilesize
600KB
-
memory/1696-61-0x0000000007BF0000-0x0000000007BFA000-memory.dmpFilesize
40KB
-
memory/1696-60-0x0000000007B80000-0x0000000007B9A000-memory.dmpFilesize
104KB
-
memory/1696-59-0x00000000081C0000-0x000000000883A000-memory.dmpFilesize
6.5MB
-
memory/1696-58-0x0000000007850000-0x00000000078F3000-memory.dmpFilesize
652KB
-
memory/1696-45-0x000000007FC50000-0x000000007FC60000-memory.dmpFilesize
64KB
-
memory/1696-46-0x0000000006E50000-0x0000000006E82000-memory.dmpFilesize
200KB
-
memory/1696-47-0x0000000072C60000-0x0000000072CAC000-memory.dmpFilesize
304KB
-
memory/1696-57-0x0000000006E00000-0x0000000006E1E000-memory.dmpFilesize
120KB
-
memory/2568-13-0x0000000001080000-0x0000000001090000-memory.dmpFilesize
64KB
-
memory/2568-73-0x0000000001080000-0x0000000001090000-memory.dmpFilesize
64KB
-
memory/2568-12-0x0000000075370000-0x0000000075921000-memory.dmpFilesize
5.7MB
-
memory/2568-72-0x0000000001080000-0x0000000001090000-memory.dmpFilesize
64KB
-
memory/2568-41-0x0000000001080000-0x0000000001090000-memory.dmpFilesize
64KB
-
memory/2568-15-0x0000000075370000-0x0000000075921000-memory.dmpFilesize
5.7MB
-
memory/2568-71-0x0000000075370000-0x0000000075921000-memory.dmpFilesize
5.7MB
-
memory/2568-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3644-0-0x0000000075370000-0x0000000075921000-memory.dmpFilesize
5.7MB
-
memory/3644-14-0x0000000075370000-0x0000000075921000-memory.dmpFilesize
5.7MB
-
memory/3644-1-0x0000000075370000-0x0000000075921000-memory.dmpFilesize
5.7MB
-
memory/3644-3-0x0000000075370000-0x0000000075921000-memory.dmpFilesize
5.7MB
-
memory/3644-2-0x00000000019D0000-0x00000000019E0000-memory.dmpFilesize
64KB
-
memory/3644-4-0x00000000019D0000-0x00000000019E0000-memory.dmpFilesize
64KB