Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 17:06
Static task
static1
Behavioral task
behavioral1
Sample
508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe
-
Size
326KB
-
MD5
508d20f4ac741b76d4fe3e4c2a51bbcd
-
SHA1
1cfe2d1d325c0ecddcd805a9857ee7b3cdebf4ec
-
SHA256
f5ed244699bfd20b6c2a9fe44f2f99aba7d0c7a27419da8c65342878d949d688
-
SHA512
2874a61be9ff2f634c39f8b68ba2a2d060e42a04a25029142d681da55cf6d742d12716a625b67120c70e92ebc81a1f0cc93851aab2f4032c28a792205e8eb296
-
SSDEEP
6144:Gl7ZoMg2kwi+M4JfLrhqtNfjfa3EYNFlV4/WIdjqmcpg1paUAd4wIzWQ:UntiyJfL+Lfa3E4+CpgzaUA3
Malware Config
Extracted
nanocore
1.2.2.0
181.215.247.6:5655
c7bb6209-5622-4e29-820a-dbb0cb99e820
-
activate_away_mode
true
-
backup_connection_host
181.215.247.6
- backup_dns_server
-
buffer_size
65535
-
build_time
2017-04-17T11:05:54.312394636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
5655
-
default_group
money team
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c7bb6209-5622-4e29-820a-dbb0cb99e820
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
181.215.247.6
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
app.exepid process 2360 app.exe -
Loads dropped DLL 1 IoCs
Processes:
508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exepid process 2224 508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
app.exedescription pid process target process PID 2360 set thread context of 1972 2360 app.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\DDP Service\ddpsv.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 1972 RegAsm.exe 1972 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1972 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exeapp.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2224 508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe Token: SeDebugPrivilege 2360 app.exe Token: SeDebugPrivilege 1972 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exeapp.exedescription pid process target process PID 2224 wrote to memory of 2360 2224 508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe app.exe PID 2224 wrote to memory of 2360 2224 508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe app.exe PID 2224 wrote to memory of 2360 2224 508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe app.exe PID 2224 wrote to memory of 2360 2224 508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe app.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe PID 2360 wrote to memory of 1972 2360 app.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\508d20f4ac741b76d4fe3e4c2a51bbcd_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\app.exe"C:\Users\Admin\AppData\Local\app.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\app.exeFilesize
326KB
MD5508d20f4ac741b76d4fe3e4c2a51bbcd
SHA11cfe2d1d325c0ecddcd805a9857ee7b3cdebf4ec
SHA256f5ed244699bfd20b6c2a9fe44f2f99aba7d0c7a27419da8c65342878d949d688
SHA5122874a61be9ff2f634c39f8b68ba2a2d060e42a04a25029142d681da55cf6d742d12716a625b67120c70e92ebc81a1f0cc93851aab2f4032c28a792205e8eb296
-
memory/1972-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1972-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2224-4-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2224-0-0x0000000075011000-0x0000000075012000-memory.dmpFilesize
4KB
-
memory/2224-15-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2224-3-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2224-2-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2224-1-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2360-12-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2360-13-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2360-14-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2360-16-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2360-17-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB
-
memory/2360-23-0x0000000075010000-0x00000000755BB000-memory.dmpFilesize
5.7MB