nanocore | ee2845452cc4f982738d1e47ae8b8fd2fd815c78bc846d5abe1a20308ad91866

Virtualization/Sandbox Evasion

T1497

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description pid process target process

PID 1924 set thread context of 280 1924 3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

496 schtasks.exe
320 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exe3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exeMSBuild.exe

pid process

2408 powershell.exe
1924 3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
280 MSBuild.exe
280 MSBuild.exe
280 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

280 MSBuild.exe

description	pid	process	target process
PID 1924 set thread context of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe

pid	process
496	schtasks.exe
320	schtasks.exe

pid	process
2408	powershell.exe
1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
280	MSBuild.exe
280	MSBuild.exe
280	MSBuild.exe

pid	process
280	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exe3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Token: SeDebugPrivilege	280	MSBuild.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exeMSBuild.exe

description	pid	process	target process
PID 1924 wrote to memory of 2408	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	powershell.exe
PID 1924 wrote to memory of 2408	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	powershell.exe
PID 1924 wrote to memory of 2408	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	powershell.exe
PID 1924 wrote to memory of 2408	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	powershell.exe
PID 1924 wrote to memory of 496	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	schtasks.exe
PID 1924 wrote to memory of 496	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	schtasks.exe
PID 1924 wrote to memory of 496	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	schtasks.exe
PID 1924 wrote to memory of 496	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	schtasks.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1924 wrote to memory of 280	1924	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 280 wrote to memory of 320	280	MSBuild.exe	schtasks.exe
PID 280 wrote to memory of 320	280	MSBuild.exe	schtasks.exe
PID 280 wrote to memory of 320	280	MSBuild.exe	schtasks.exe
PID 280 wrote to memory of 320	280	MSBuild.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SXvGTDXt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC2A.tmp"
2⤵
- Creates scheduled task(s)
PID:496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:280

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ISS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFDB0.tmp"
3⤵
- Creates scheduled task(s)
PID:320

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

4

Virtualization/Sandbox Evasion

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery