Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 01:40
Static task
static1
Behavioral task
behavioral1
Sample
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
48fbb875dd0cbb3ae7f145c0f987cc4d
-
SHA1
c44a58bb0112eb5e6b21e35501462dbb8feafee7
-
SHA256
cf7b5bff87c89be9605b7747a603195f997874b8874c8867626bbaeb444d38a9
-
SHA512
0ca5589eb91f5a9f3f14387fa6d0f2186e8d61a194bdd1b9d894c226773d9ae1da8c72a7c5f1715f3909580e7d273dea9a4c2c50e3998492140b98c68ffae463
-
SSDEEP
24576:ru6Jx3O0c+JY5UZ+XC0kGso/Wai65neExWY:FI0c++OCvkGsUWai+eZY
Malware Config
Extracted
nanocore
1.2.2.0
nowyouseeme.ddns.net:4180
nowme.gleeze.com:4180
2449e2e0-293a-4268-9590-ad05403a16aa
-
activate_away_mode
true
-
backup_connection_host
nowme.gleeze.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-03-16T22:49:54.051470136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4180
-
default_group
port nano
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
2449e2e0-293a-4268-9590-ad05403a16aa
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
nowyouseeme.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\oobeldr\recdisc.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exedescription pid process target process PID 4776 set thread context of 1928 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
RegAsm.exe48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exepid process 1928 RegAsm.exe 1928 RegAsm.exe 1928 RegAsm.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1928 RegAsm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exepid process 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1928 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exepid process 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exepid process 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exedescription pid process target process PID 4776 wrote to memory of 2696 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe cmd.exe PID 4776 wrote to memory of 2696 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe cmd.exe PID 4776 wrote to memory of 2696 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe cmd.exe PID 4776 wrote to memory of 1928 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe RegAsm.exe PID 4776 wrote to memory of 1928 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe RegAsm.exe PID 4776 wrote to memory of 1928 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe RegAsm.exe PID 4776 wrote to memory of 1928 4776 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\oobeldr\recdisc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\oobeldr\recdisc.exeFilesize
1.0MB
MD548fbb875dd0cbb3ae7f145c0f987cc4d
SHA1c44a58bb0112eb5e6b21e35501462dbb8feafee7
SHA256cf7b5bff87c89be9605b7747a603195f997874b8874c8867626bbaeb444d38a9
SHA5120ca5589eb91f5a9f3f14387fa6d0f2186e8d61a194bdd1b9d894c226773d9ae1da8c72a7c5f1715f3909580e7d273dea9a4c2c50e3998492140b98c68ffae463
-
memory/1928-4-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1928-5-0x00000000734A2000-0x00000000734A3000-memory.dmpFilesize
4KB
-
memory/1928-6-0x00000000734A0000-0x0000000073A51000-memory.dmpFilesize
5.7MB
-
memory/1928-7-0x00000000734A0000-0x0000000073A51000-memory.dmpFilesize
5.7MB
-
memory/1928-9-0x00000000734A2000-0x00000000734A3000-memory.dmpFilesize
4KB
-
memory/1928-10-0x00000000734A0000-0x0000000073A51000-memory.dmpFilesize
5.7MB
-
memory/4776-3-0x0000000000CC0000-0x0000000000CC3000-memory.dmpFilesize
12KB