Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 18:35
Static task
static1
Behavioral task
behavioral1
Sample
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe
-
Size
265KB
-
MD5
085835acd102be8ae20f06e3bcd1c286
-
SHA1
6b094f2758e3eb5de80694332c7c230cddd4d56c
-
SHA256
dfaef1fc73070ec9c9c82054c45852aed5bd3cbf3d05b1e5dc3e0da7d9c8bf60
-
SHA512
949609cab86dc8edb2188c95a10dc82db87eab8a61032e608b057adfe710d2dfc4d97f229930ad2650c520d44a5f3de68acdd3850bd10ca8dc37ef73c11cd5aa
-
SSDEEP
6144:xCOpqpmLKQFA+C+DLztBFUY+kzdCJe6Dcr5u:jpqprQo+3zNUYirAr
Malware Config
Extracted
nanocore
1.2.2.0
84.38.133.178:6498
34997c50-6cd9-4e52-8d4a-91b63f55380d
-
activate_away_mode
true
-
backup_connection_host
84.38.133.178
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-23T22:29:43.876535636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6498
-
default_group
New Logz
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
34997c50-6cd9-4e52-8d4a-91b63f55380d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
84.38.133.178
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exedescription pid process target process PID 4104 set thread context of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2896 schtasks.exe 1404 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exeRegSvcs.exepid process 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe 3924 RegSvcs.exe 3924 RegSvcs.exe 3924 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 3924 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe Token: SeDebugPrivilege 3924 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 4104 wrote to memory of 2896 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe schtasks.exe PID 4104 wrote to memory of 2896 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe schtasks.exe PID 4104 wrote to memory of 2896 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe schtasks.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 4104 wrote to memory of 3924 4104 085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe RegSvcs.exe PID 3924 wrote to memory of 1404 3924 RegSvcs.exe schtasks.exe PID 3924 wrote to memory of 1404 3924 RegSvcs.exe schtasks.exe PID 3924 wrote to memory of 1404 3924 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\085835acd102be8ae20f06e3bcd1c286_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BKruiAd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3776.tmp"2⤵
- Creates scheduled task(s)
PID:2896 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DSL Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3AE1.tmp"3⤵
- Creates scheduled task(s)
PID:1404
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵PID:2800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD528a030c7e73df0bc6ae6ab4bd7b588cc
SHA1708b9cc656cb69a5d50218157e478ba7427671f5
SHA2567a106127d8ee23947af7a1b4daa25fc2f417f618f265779c6497da9468a41a11
SHA512d0a26796e720a07c8ea674be61fa32fb6cdfbad0cd4519336ffc18f1dc7c6d63316f5077c802b61401e884a41ba65d4ce2fe7b39e13638b70fa0b4551f71cf0a
-
Filesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5