Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 11:01
Static task
static1
Behavioral task
behavioral1
Sample
f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe
-
Size
886KB
-
MD5
f359c569b703f59767d4f322c08ffd1b
-
SHA1
176ff19dad6778406d0ce0033a3f4116a2877f57
-
SHA256
dbfc1426b8273f1490e9f8b61929a3e00fdeefaaef7a4400a1dae2ed2f953a38
-
SHA512
d143905bb52e0260e40da5a77158066ede52721f4bac7a769f67078565fc886f9cc15f8228813c23f9c41063b73195dde17e06808c3fbf06bd9b0e6eb1f0c19e
-
SSDEEP
12288:6B/QmMeIgJ/dfZdm1zBmbMMm21dZL4XsgL0Ec:g/Qg4pBmo3W40r
Malware Config
Extracted
nanocore
1.2.2.0
tzitziklishop.ddns.net:1665
76131181-f427-4fea-9060-b76d3b69a321
-
activate_away_mode
true
-
backup_connection_host
tzitziklishop.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-05-29T02:49:42.057419436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1665
-
default_group
AUGUST
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
76131181-f427-4fea-9060-b76d3b69a321
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
tzitziklishop.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Host = "C:\\Program Files (x86)\\ISS Host\\isshost.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exedescription pid process target process PID 2280 set thread context of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\ISS Host\isshost.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\ISS Host\isshost.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2596 schtasks.exe 2716 schtasks.exe 1924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exeRegSvcs.exepid process 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe 2120 RegSvcs.exe 2120 RegSvcs.exe 2120 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2120 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe Token: SeDebugPrivilege 2120 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 2280 wrote to memory of 2716 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe schtasks.exe PID 2280 wrote to memory of 2716 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe schtasks.exe PID 2280 wrote to memory of 2716 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe schtasks.exe PID 2280 wrote to memory of 2716 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe schtasks.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2280 wrote to memory of 2120 2280 f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe RegSvcs.exe PID 2120 wrote to memory of 1924 2120 RegSvcs.exe schtasks.exe PID 2120 wrote to memory of 1924 2120 RegSvcs.exe schtasks.exe PID 2120 wrote to memory of 1924 2120 RegSvcs.exe schtasks.exe PID 2120 wrote to memory of 1924 2120 RegSvcs.exe schtasks.exe PID 2120 wrote to memory of 2596 2120 RegSvcs.exe schtasks.exe PID 2120 wrote to memory of 2596 2120 RegSvcs.exe schtasks.exe PID 2120 wrote to memory of 2596 2120 RegSvcs.exe schtasks.exe PID 2120 wrote to memory of 2596 2120 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f359c569b703f59767d4f322c08ffd1b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uLYBYmiNfIUD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC62.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF576.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF69F.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEC62.tmpFilesize
1KB
MD592df2bdb6d582bfbb34f901078bc08bd
SHA1ab5e22864f71e5a54f0b71fee3819198a6f5f329
SHA2566fd3fdd98711d0b977840f9d3e906a3e04bf5d7a31a4ea078ae640b6d1421cfc
SHA5121617ea0987ede184514fe0485ba2ca082d5019a56cf83a168b63f74dcad05388939c4200711411c1301ff485fe923d93e03db1e836f3b7fe4157c1bdc4cbbd44
-
C:\Users\Admin\AppData\Local\Temp\tmpF576.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmpF69F.tmpFilesize
1KB
MD53d1580c0395f6de62659467f5b7f1acf
SHA18e73a3885896cecca7ff799a272fc9ddfe06ea96
SHA2566f40196c42a171f24a3e16edeca664cdc5a2f7c150d468255b0e14ab10a2b714
SHA5127637c0d9b03227dffcb00a68d97ddce60bfc40ca0f8a7a4bbd700ea56be6d570908511dea5cab9f609a7da2e558e5298c482fd1e330af085f9c52867d5a847ea
-
memory/2120-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2120-24-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/2120-38-0x0000000000E50000-0x0000000000E90000-memory.dmpFilesize
256KB
-
memory/2120-37-0x0000000000E50000-0x0000000000E90000-memory.dmpFilesize
256KB
-
memory/2120-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2120-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2120-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2120-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2120-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2120-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2120-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2120-36-0x0000000000E50000-0x0000000000E90000-memory.dmpFilesize
256KB
-
memory/2120-35-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/2120-25-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/2120-34-0x0000000000E50000-0x0000000000E90000-memory.dmpFilesize
256KB
-
memory/2120-33-0x0000000000E50000-0x0000000000E90000-memory.dmpFilesize
256KB
-
memory/2280-1-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/2280-2-0x0000000000190000-0x00000000001D0000-memory.dmpFilesize
256KB
-
memory/2280-23-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/2280-4-0x0000000000190000-0x00000000001D0000-memory.dmpFilesize
256KB
-
memory/2280-0-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB
-
memory/2280-3-0x0000000074C20000-0x00000000751CB000-memory.dmpFilesize
5.7MB