nanocore | e99ff6e0ecf712843b4b7632ba6e66a99a86b4ad8197d4b70398115f92e35790

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe
Size 330KB
Sample240507-vhf31sfd2w
SHA256 e99ff6e0ecf712843b4b7632ba6e66a99a86b4ad8197d4b70398115f92e35790
MD5 211e0d6524e3575f72b55ea0fdf47355
SHA1 94a4181475c23bd06c44797a4eaa956e828ff6e0
SHA512 7188fef3603361fc7a01e8d390294f4a70c8359ff55ee65b7e74a9a47f5fc3547d3d703ec9dfcc80b735a955b0c95e87983f95d2a7df8126aa2b99f033d4b246
SSDEEP 6144:fo/MViU3ammOVx5mwzgUgqBKt+VqnngdOKoV5zr5JrOg3MwbpN2taocx8crL/:theOVx5megUZYtOqeOfVZPrOgcQO05D3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger spyware stealer trojan upx

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a0000000233b9-22.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a0000000233b9-22.dat	upx
behavioral2/memory/4608-44-0x00000000735F0000-0x000000007361E000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4608 set thread context of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 4196	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	98
PID 4608 wrote to memory of 1524	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	84
PID 4608 wrote to memory of 784	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	8
PID 4608 wrote to memory of 2556	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	42
PID 4608 wrote to memory of 1764	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	31
PID 4608 wrote to memory of 384	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	61
PID 4608 wrote to memory of 2156	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	38
PID 4608 wrote to memory of 380	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	13
PID 4608 wrote to memory of 1560	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	27
PID 4608 wrote to memory of 1552	4608	211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe	26

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2156

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2556

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:384

C:\Users\Admin\AppData\Local\Temp\211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\211e0d6524e3575f72b55ea0fdf47355_JaffaCakes118.exe"
  2⤵
  - Checks whether UAC is enabled
  PID:4196

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp903E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp903E.tmp
Size 66KB
SHA256 e71ba7ce01d10e60a4feac7fc5e04f34756ba621c7d88583d0f96bd3b2655647
MD5 aaa698721f488b181bc0f0afc5da126a
SHA1 76536a73f16ffd643ea24f8725cebfff9d49852f
SHA512 67d8b05678fbdc1678515c341fa8c1e26f3d1b15f2cc390bb9b1a26589a346fd57697dd3366e72d46ab265570929f1be89b8aec81112a2a98194c5886c89261d
SSDEEP 1536:yBa4WOP269sBD/HH1UxFNmp3bPmRsauxHhzfuiLnxk:spWz69sBD/n1UvNmprD/xHN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4196-48-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4196-11-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4196-46-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4196-47-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4196-50-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4196-51-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4196-52-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4608-2-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4608-1-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4608-42-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4608-45-0x00000000755A0000-0x0000000075B51000-memory.dmp

Download

memory/4608-0-0x00000000755A2000-0x00000000755A3000-memory.dmp

Download

memory/4608-44-0x00000000735F0000-0x000000007361E000-memory.dmp

Download