nanocore | b1f9c2d953353ef09e7b14ba1400b0b6df063f52c7158925848da51aab76909f

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe
Size

202KB
MD5

3e7f6c4296815f50ba70afe3fca135b6
SHA1

f5c8f296c900c892f634711974d3d84f9a63d980
SHA256

b1f9c2d953353ef09e7b14ba1400b0b6df063f52c7158925848da51aab76909f
SHA512

4263402202ea676fb078c6b0ee35b8ac8b8ca56f36515025e7f179b83f12e5979ae189aa57394be039ac23897f6877107ac7a0f9993464517e7daeef23e3997c
SSDEEP

3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIJtEw2XuQQw0cDT2la22dCaf8o:wLV6Bta6dtJmakIM50Q4l/2UaU1Nmxt

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

pid	process
1004	3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe
1004	3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe
1004	3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

pid process

1004 3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1004 3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1004	3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e7f6c4296815f50ba70afe3fca135b6_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3888,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
1⤵
PID:2156

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-0-0x0000000075262000-0x0000000075263000-memory.dmp

Filesize
4KB

Download
memory/1004-1-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/1004-2-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/1004-4-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/1004-5-0x0000000075262000-0x0000000075263000-memory.dmp

Filesize
4KB

Download
memory/1004-6-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/1004-7-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download