nanocore | ee2845452cc4f982738d1e47ae8b8fd2fd815c78bc846d5abe1a20308ad91866

Virtualization/Sandbox Evasion

T1497

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe

description pid process target process

PID 3068 set thread context of 1980 3068 3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1724 schtasks.exe
4516 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exeMSBuild.exe

pid process

3756 powershell.exe
3756 powershell.exe
1980 MSBuild.exe
1980 MSBuild.exe
1980 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

1980 MSBuild.exe

description	pid	process	target process
PID 3068 set thread context of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe

pid	process
1724	schtasks.exe
4516	schtasks.exe

pid	process
3756	powershell.exe
3756	powershell.exe
1980	MSBuild.exe
1980	MSBuild.exe
1980	MSBuild.exe

pid	process
1980	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exe3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
Token: SeDebugPrivilege	1980	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exeMSBuild.exe

description	pid	process	target process
PID 3068 wrote to memory of 3756	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	powershell.exe
PID 3068 wrote to memory of 3756	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	powershell.exe
PID 3068 wrote to memory of 3756	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	powershell.exe
PID 3068 wrote to memory of 1724	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	schtasks.exe
PID 3068 wrote to memory of 1724	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	schtasks.exe
PID 3068 wrote to memory of 1724	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	schtasks.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 3068 wrote to memory of 1980	3068	3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe	MSBuild.exe
PID 1980 wrote to memory of 4516	1980	MSBuild.exe	schtasks.exe
PID 1980 wrote to memory of 4516	1980	MSBuild.exe	schtasks.exe
PID 1980 wrote to memory of 4516	1980	MSBuild.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d63d1c5a34c44dbb9afda0989b55295_JaffaCakes118.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SXvGTDXt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FD1.tmp"
2⤵
- Creates scheduled task(s)
PID:1724

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5416.tmp"
3⤵
- Creates scheduled task(s)
PID:4516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

5

Virtualization/Sandbox Evasion

T1497

System Information Discovery

4

Peripheral Device Discovery