Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-04-2024 08:56

General

  • Target

    fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe

  • Size

    291KB

  • MD5

    fee9cf8ec3de16009f0ffecdb2a8a831

  • SHA1

    93af1af6f4d7ba623f03892032a805a099e2ab3c

  • SHA256

    155f0bd1a6d92bf811c5157707eec4780d4b17cf6fb1166200a9d1ab9b93da48

  • SHA512

    70e7e5b0810df304774d547d14546b13dfea0e4a69775589ec1d9727868e0dba9db76948749274ebfd11551465ec6a432edc77ead4111f713abc10fb713f6e66

  • SSDEEP

    6144:/FVFmmoBy8TCukZw8db2cETk0MmsN6798y89xih5Mp:9mhy8TCukZJ2cETkAs2jU

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

netserv.serveftp.com:55128

176.31.174.37:55128

Mutex

4b736bf9-5142-40fe-ab51-5c64053db0ff

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    176.31.174.37

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2015-04-03T18:30:02.293302936Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    55128

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4b736bf9-5142-40fe-ab51-5c64053db0ff

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    netserv.serveftp.com

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Users\Admin\AppData\Local\Temp\sql_support.exe
      "C:\Users\Admin\AppData\Local\Temp\sql_support.exe" -woohoo 2580 C:\Users\Admin\AppData\Local\Temp\ndmgr.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    475f0cc45e2c54ac6583403530c06810

    SHA1

    8f1167fd739015fa9e40a2bdb3db9e18ebedf7b3

    SHA256

    19daf5bd0627a03a17f45ca7dbe0cf0d8e3ccbc33f58eaf1fff3b2a554f39772

    SHA512

    f190e23c72688e8d31ffff5a1c482e47cfa7fe78fb9815dd37bb23e29faa197427e3b22be76597637cf296ded35e498ed7adc1d902cd9245c3e3065a69325932

  • C:\Users\Admin\AppData\Local\Temp\Cab27CC.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\sql_support.exe

    Filesize

    291KB

    MD5

    fee9cf8ec3de16009f0ffecdb2a8a831

    SHA1

    93af1af6f4d7ba623f03892032a805a099e2ab3c

    SHA256

    155f0bd1a6d92bf811c5157707eec4780d4b17cf6fb1166200a9d1ab9b93da48

    SHA512

    70e7e5b0810df304774d547d14546b13dfea0e4a69775589ec1d9727868e0dba9db76948749274ebfd11551465ec6a432edc77ead4111f713abc10fb713f6e66

  • memory/2212-1-0x0000000000570000-0x00000000005B0000-memory.dmp

    Filesize

    256KB

  • memory/2212-0-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/2212-2-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/2212-12-0x0000000000570000-0x00000000005B0000-memory.dmp

    Filesize

    256KB

  • memory/2212-59-0x0000000000570000-0x00000000005B0000-memory.dmp

    Filesize

    256KB

  • memory/2212-58-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/2212-60-0x0000000000570000-0x00000000005B0000-memory.dmp

    Filesize

    256KB

  • memory/2580-16-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2580-32-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2580-30-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2580-61-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-42-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/2580-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2580-24-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2580-21-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2580-18-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2580-14-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/3032-43-0x00000000001B0000-0x00000000001F0000-memory.dmp

    Filesize

    256KB

  • memory/3032-57-0x00000000001B0000-0x00000000001F0000-memory.dmp

    Filesize

    256KB

  • memory/3032-44-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/3032-62-0x00000000001B0000-0x00000000001F0000-memory.dmp

    Filesize

    256KB

  • memory/3032-63-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/3032-64-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

  • memory/3032-65-0x00000000001B0000-0x00000000001F0000-memory.dmp

    Filesize

    256KB