Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe
-
Size
982KB
-
MD5
f439ba7e42c8f643adcbe72a3c744054
-
SHA1
c8d58396ce49078d5c5d5b0511ee132480404d1d
-
SHA256
6a7045cccb222af55aa8425e4ed2e03702be0330f1694558385941463cde98b1
-
SHA512
11d62ec7f8b447cacef04c5b05739491b280f5c7aafbac64ff251e309fbf6b9f1c172c4cc7e7048ab2da8674052d98aa42621efc9e3641fc0d370a9553cce229
-
SSDEEP
12288:gtl9Dc9F3nC0Py3gAh1EJbjJEKcMU/H6OZE1eWmDF/akh0hefrgHvDkUx5skTX8P:MMUP6mE12hCu0he0PAc/TDxqMa
Malware Config
Extracted
nanocore
1.2.2.0
sobe123.ddns.net:5656
127.0.0.1:5656
8a1be7ed-1b25-4346-8844-80b424a6856e
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-05-14T20:49:02.304193536Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5656
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
8a1be7ed-1b25-4346-8844-80b424a6856e
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sobe123.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5024
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exedescription pid process target process PID 772 set thread context of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2520 schtasks.exe 4544 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exeMSBuild.exepid process 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe 3308 MSBuild.exe 3308 MSBuild.exe 3308 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 3308 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe Token: SeDebugPrivilege 3308 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exeMSBuild.exedescription pid process target process PID 772 wrote to memory of 2520 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe schtasks.exe PID 772 wrote to memory of 2520 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe schtasks.exe PID 772 wrote to memory of 2520 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe schtasks.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 772 wrote to memory of 3308 772 f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe MSBuild.exe PID 3308 wrote to memory of 4544 3308 MSBuild.exe schtasks.exe PID 3308 wrote to memory of 4544 3308 MSBuild.exe schtasks.exe PID 3308 wrote to memory of 4544 3308 MSBuild.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f439ba7e42c8f643adcbe72a3c744054_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EhhxOmbojoO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD126.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SMTP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDA9C.tmp"3⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD126.tmpFilesize
1KB
MD5bff0400f00bfe9ce43c9745f64161214
SHA13df6f99605ed8024f3e14e30cee99f71fe719754
SHA25668646c5be853bef6613100cf11d319e9854b3c94570c21e6648ee861ac04ce65
SHA51235c79a22a174aa0b4705805317b0e079e8b29046fe491767d78f125ad611313993976bd779fefe9338bf4801f191b0820d230165411bf580e623a18255ff41e0
-
C:\Users\Admin\AppData\Local\Temp\tmpDA9C.tmpFilesize
1KB
MD53e2b26ed8b75ae83a269595180e84ef6
SHA1d30a0335fcce406bca8ba5764288235e6192f608
SHA256108be30aeb8eb31c185a39a6726f26dacbc4e4124951c61a29ade4b7038c71ea
SHA512b6981c68fcb886cc8379a068b96931b9d4f5cc5aa9bdc467e36c4168fe6c5273a2a84d8850b12c11703ec03ac6b1f1950d1e669efcb59fc2402ce4bba9dc03d3
-
memory/772-6-0x0000000005280000-0x000000000528A000-memory.dmpFilesize
40KB
-
memory/772-20-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/772-2-0x0000000005990000-0x0000000005F34000-memory.dmpFilesize
5.6MB
-
memory/772-5-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/772-0-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/772-7-0x00000000055B0000-0x00000000055C8000-memory.dmpFilesize
96KB
-
memory/772-8-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/772-9-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/772-10-0x0000000006FB0000-0x0000000007056000-memory.dmpFilesize
664KB
-
memory/772-1-0x00000000007E0000-0x00000000008DC000-memory.dmpFilesize
1008KB
-
memory/772-4-0x00000000053E0000-0x000000000547C000-memory.dmpFilesize
624KB
-
memory/772-3-0x00000000052C0000-0x0000000005352000-memory.dmpFilesize
584KB
-
memory/772-11-0x00000000095C0000-0x00000000095F8000-memory.dmpFilesize
224KB
-
memory/3308-32-0x00000000059C0000-0x00000000059D0000-memory.dmpFilesize
64KB
-
memory/3308-21-0x00000000059C0000-0x00000000059D0000-memory.dmpFilesize
64KB
-
memory/3308-19-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/3308-26-0x0000000005710000-0x000000000571A000-memory.dmpFilesize
40KB
-
memory/3308-27-0x0000000005D10000-0x0000000005D2E000-memory.dmpFilesize
120KB
-
memory/3308-28-0x0000000006850000-0x000000000685A000-memory.dmpFilesize
40KB
-
memory/3308-29-0x00000000059C0000-0x00000000059D0000-memory.dmpFilesize
64KB
-
memory/3308-30-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/3308-31-0x00000000059C0000-0x00000000059D0000-memory.dmpFilesize
64KB
-
memory/3308-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB