Analysis
-
max time kernel
134s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 18:35
Static task
static1
Behavioral task
behavioral1
Sample
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe
-
Size
265KB
-
MD5
085835acd102be8ae20f06e3bcd1c286
-
SHA1
6b094f2758e3eb5de80694332c7c230cddd4d56c
-
SHA256
dfaef1fc73070ec9c9c82054c45852aed5bd3cbf3d05b1e5dc3e0da7d9c8bf60
-
SHA512
949609cab86dc8edb2188c95a10dc82db87eab8a61032e608b057adfe710d2dfc4d97f229930ad2650c520d44a5f3de68acdd3850bd10ca8dc37ef73c11cd5aa
-
SSDEEP
6144:xCOpqpmLKQFA+C+DLztBFUY+kzdCJe6Dcr5u:jpqprQo+3zNUYirAr
Malware Config
Extracted
nanocore
1.2.2.0
84.38.133.178:6498
34997c50-6cd9-4e52-8d4a-91b63f55380d
-
activate_away_mode
true
-
backup_connection_host
84.38.133.178
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-23T22:29:43.876535636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6498
-
default_group
New Logz
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
34997c50-6cd9-4e52-8d4a-91b63f55380d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
84.38.133.178
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exedescription pid process target process PID 1728 set thread context of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2440 schtasks.exe 2236 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exeRegSvcs.exepid process 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe 2888 RegSvcs.exe 2888 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2888 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe Token: SeDebugPrivilege 2888 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 1728 wrote to memory of 2440 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe schtasks.exe PID 1728 wrote to memory of 2440 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe schtasks.exe PID 1728 wrote to memory of 2440 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe schtasks.exe PID 1728 wrote to memory of 2440 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe schtasks.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 1728 wrote to memory of 2888 1728 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 2888 wrote to memory of 2236 2888 RegSvcs.exe schtasks.exe PID 2888 wrote to memory of 2236 2888 RegSvcs.exe schtasks.exe PID 2888 wrote to memory of 2236 2888 RegSvcs.exe schtasks.exe PID 2888 wrote to memory of 2236 2888 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BKruiAd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9405.tmp"2⤵
- Creates scheduled task(s)
PID:2440 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9AE8.tmp"3⤵
- Creates scheduled task(s)
PID:2236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51706ee0130af070e2f7815db1b00258f
SHA1b7f990745bb1709a1e65ab9d8708f6f4a852c479
SHA256b5c3bb13bb12b85878598d7a8fb258f4137029519122abb13a414318ab234c8b
SHA512bfb74beea8b215df9a872d795395d03535a84d790ffd4059c282923227dd4f9893f0578a295e77f1d022fc0a20c067100499a6d48e96dcbe60439d22a08ce684
-
Filesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5