nanocore | 6c3390a9396a3b7fb5851b9d4f7973988829ba7b19b47d1ff673ff0851be6edc

General

Target

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe
Size

218KB
MD5

7a95b334409d5c2ee3aaaa55fbd73aca
SHA1

12a2103b3cf925e8810a24f706b1d55ba2719eaf
SHA256

6c3390a9396a3b7fb5851b9d4f7973988829ba7b19b47d1ff673ff0851be6edc
SHA512

091fd5e3f9c993e6a33f619d569878df39a99ec9a001f7c6479b970eb24a8b5b87c6fe16c4d2b69eda2ca1d1b8eeda35b8357049e8498634857b119a75c2dd04
SSDEEP

3072:8zEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HItz5iT05t4Ziu8hBVv4TPcXQZA:8LV6Bta6dtJmakIM5MmGtMMnEcXs7hmr

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Service = "C:\\Program Files (x86)\\AGP Service\\agpsv.exe"	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

Processes:

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Service\agpsv.exe	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\AGP Service\agpsv.exe	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1596 schtasks.exe
2300 schtasks.exe

pid	process
1596	schtasks.exe
2300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

pid	process
4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe
4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe
4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

pid process

4352 7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe
Token: SeDebugPrivilege	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe

description	pid	process	target process
PID 4352 wrote to memory of 1596	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe	schtasks.exe
PID 4352 wrote to memory of 1596	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe	schtasks.exe
PID 4352 wrote to memory of 1596	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe	schtasks.exe
PID 4352 wrote to memory of 2300	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe	schtasks.exe
PID 4352 wrote to memory of 2300	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe	schtasks.exe
PID 4352 wrote to memory of 2300	4352	7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7a95b334409d5c2ee3aaaa55fbd73aca_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp446B.tmp"
2⤵
- Creates scheduled task(s)
PID:1596

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp44CA.tmp"
2⤵
- Creates scheduled task(s)
PID:2300

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp446B.tmp
Filesize
1KB

MD5
22eb8699d64784ec8fb7eb592f4defa2

SHA1
b3296c02cba5d7223c856e78509c03c592debcf8

SHA256
729cce003dfd6e17ef47fcfa17dcfaa0315433fe55c4d2327f83b0754909ff22

SHA512
fac84274cfcea20381ee9c1c4808036f14ced8737f26feaf7e7688f303fcb038a871721cf85659fc0f7232cc7958d49b67ea2523083f5b75923d730232a0a9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp44CA.tmp
Filesize
1KB

MD5
7a81ae69c04c8d95261eb5f490b7f869

SHA1
9f4f484d306fea15b2e7f9f16db660833bb1f8ce

SHA256
ce3933e772f663a834335cc2071e5e7b2d49a065b51d84a259054b8ef663e785

SHA512
8260ab83106752a488e164bbed63ef334d34399bc9a5c09a0cfceba6aef48eafe5c64e4dfbd353ac3edfff2523b16c2b0287d34833a293c4436e068fae656de8

Download Submit
memory/4352-0-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

Filesize
4KB

Download
memory/4352-1-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/4352-2-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/4352-10-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/4352-11-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/4352-12-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

Filesize
4KB

Download
memory/4352-13-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/4352-14-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads