Overview

overview

10

Static

static

3

7ed110b318...18.exe

windows7-x64

10

7ed110b318...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 23:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7ed110b3187946b1eedb675667d955bb_JaffaCakes118.exe
  • Size 890KB
  • Sample240528-3sh95aae54
  • SHA256 af73f68d674b8186fcb60a28ecb90597be4d885330593fb1a53cd1449264ad20
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
nanocorekeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • franexserver.webhop.me:10010

  • franex.gotdns.ch:10010

Mutex

  • 1b346204-51c0-42e9-b4cc-62035874f7fd

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    franex.gotdns.ch

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2018-06-16T12:08:39.779926536Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    10010

  • default_group

    sTART

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    1b346204-51c0-42e9-b4cc-62035874f7fd

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    franexserver.webhop.me

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ed110b3187946b1eedb675667d955bb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7ed110b3187946b1eedb675667d955bb_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Users\Admin\AppData\Local\Temp\14321638\sdk.exe
      "C:\Users\Admin\AppData\Local\Temp\14321638\sdk.exe" dxx=isb
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Users\Admin\AppData\Local\Temp\14321638\sdk.exe
        C:\Users\Admin\AppData\Local\Temp\14321638\sdk.exe C:\Users\Admin\AppData\Local\Temp\14321638\XPUZL
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2220
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2120

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        XPUZL
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\XPUZL
        • Size 86KB
        • SHA256 0b2555e631c85a6372e0a1abbdcdb605d05ea4475758f9fe66645c1b824a0548
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ahw.docx
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\ahw.docx
        • Size 603B
        • SHA256 99e72108d66066542a9001b08789639e4bbbfeaf5ff29912f44e978eb388e2a8
        • MD5 SHA1 SHA512
        Submit Download

        asf.docx
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\asf.docx
        • Size 516B
        • SHA256 47e879da9200f3c0344e27c0ab6d0a53f0467890e20d8eeedb4ac3c75db18c29
        • MD5 SHA1 SHA512
        Submit Download

        bed.ppt
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\bed.ppt
        • Size 601B
        • SHA256 ee951c22c4756ad3769dde1ea0d9340fb0b3590109938fa5902bed55acef67a4
        • MD5 SHA1 SHA512
        Submit Download

        blc.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\blc.bmp
        • Size 561B
        • SHA256 5eac2f16e6fcedf4f497da0c0d7af8726fbcf0d76482f69b45121ada446a14ae
        • MD5 SHA1 SHA512
        Submit Download

        bot.docx
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\bot.docx
        • Size 581KB
        • SHA256 984f5457358a876bd9471c4a61c20ba5d284104c36c34f5888c3578b57053ad3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ciu.docx
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\ciu.docx
        • Size 534B
        • SHA256 cc7d002c3b3b41190de76e8fd859d27241a3f0e4ff6ef99ad4838614a4d28fd9
        • MD5 SHA1 SHA512
        Submit Download

        ddd.xl
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\ddd.xl
        • Size 509B
        • SHA256 9e6b538b6fb2221e14401c6316673cda496d0dcc70f83fd04408af647c5073cc
        • MD5 SHA1 SHA512
        Submit Download

        dea.pdf
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\dea.pdf
        • Size 506B
        • SHA256 9406045d347f01b0d4852a720f96787eeffa05d7a2189e2cdc452d6b2cce2c02
        • MD5 SHA1 SHA512
        Submit Download

        deg.icm
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\deg.icm
        • Size 507B
        • SHA256 df4522b2f9c7cd59b78bf7058ca20203ce24f74c7ea5ddeb490a9758ccdb7e8d
        • MD5 SHA1 SHA512
        Submit Download

        dxx=isb
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\dxx=isb
        • Size 228KB
        • SHA256 2f88ee674aabee191dbe93a93cd62e9606cb34003e5a070439ac5862d091b980
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        edl.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\edl.mp3
        • Size 656B
        • SHA256 4d4ae0a3f19ce164e20adfea093c7f4faf3426c37902a9a78156fa51693c9c17
        • MD5 SHA1 SHA512
        Submit Download

        eef.ppt
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\eef.ppt
        • Size 527B
        • SHA256 6761c5afcdb47645fbb469d3a8fb5c5c7ae0ad998af2e7940030147fec6bb278
        • MD5 SHA1 SHA512
        Submit Download

        fcr.txt
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\fcr.txt
        • Size 518B
        • SHA256 191a105c67ee1cc3991b384774cca3cc9f32958f3f915ed916d7e59b50bf4cf8
        • MD5 SHA1 SHA512
        Submit Download

        fmc.ppt
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\fmc.ppt
        • Size 532B
        • SHA256 98e7a36468a4a6f85c11e0c3a9e33250829f9dffc506040fce031cf0aa12c2c7
        • MD5 SHA1 SHA512
        Submit Download

        fto.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\fto.bmp
        • Size 507B
        • SHA256 49e5411f08e1897dd17ed4d8b44cdffc4e50145add22a324b99932bf0af2924b
        • MD5 SHA1 SHA512
        Submit Download

        ghx.ppt
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\ghx.ppt
        • Size 632B
        • SHA256 ac6757446877022839db3d48fcd94dff659ef7ed2b79f6a89bc9c82076dd91b0
        • MD5 SHA1 SHA512
        Submit Download

        gvm.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\gvm.jpg
        • Size 509B
        • SHA256 8a99f02ebda9bd4d8cf6681e5f718ded6f45d67b5a3173cfdebd148318b0f823
        • MD5 SHA1 SHA512
        Submit Download

        hwj.dat
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\hwj.dat
        • Size 577B
        • SHA256 9488012f8ea27a88f1222f43f1e2fe702e3d34b4b4c1aba05c704b385bc6cf26
        • MD5 SHA1 SHA512
        Submit Download

        irr.ppt
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\irr.ppt
        • Size 543B
        • SHA256 be81d71a034d15fddac79e21454c90740afbee16f69c4cda864fe4213632c59b
        • MD5 SHA1 SHA512
        Submit Download

        ixp.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\ixp.mp3
        • Size 607B
        • SHA256 1946c5973b4e006e9a374409b0328cf7789d592b0d536b967ded1f6d4040bb0a
        • MD5 SHA1 SHA512
        Submit Download

        jws.xl
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\jws.xl
        • Size 542B
        • SHA256 3dcac850f18671efb46bca25a365f2ce666550a7d28c2d7ed3d0fbb75fef4d0f
        • MD5 SHA1 SHA512
        Submit Download

        laf.pdf
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\laf.pdf
        • Size 590B
        • SHA256 d3c1f48715202c63ed80d3b09d55d79155ec6f8acfa61ab8504f9d33b63aca2d
        • MD5 SHA1 SHA512
        Submit Download

        mcf.pdf
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\mcf.pdf
        • Size 546B
        • SHA256 7e66843b69d237790aed25938a50c5420fcb590e7f9e428b181d5b828178249f
        • MD5 SHA1 SHA512
        Submit Download

        mdq.dat
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\mdq.dat
        • Size 567B
        • SHA256 0d2b93aa136ccbfa74fca7f998f46c0227168cbf492564375f625f587aba0d5d
        • MD5 SHA1 SHA512
        Submit Download

        mim.mp4
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\mim.mp4
        • Size 521B
        • SHA256 ae8bd7ea313eac2971c55f0c3504a3a389e5fd42b5d3aa21ca0204123c2192a8
        • MD5 SHA1 SHA512
        Submit Download

        mpa.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\mpa.mp3
        • Size 563B
        • SHA256 9a3cb96a053e4b5c3dbe54b03555a20b04cfd7917aafb19366696301be1a899d
        • MD5 SHA1 SHA512
        Submit Download

        nei.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\nei.bmp
        • Size 546B
        • SHA256 2e9573f5d6a0cce7be5aedb6f4bdbd9a232bb08937c14e7267396b3b22cffdab
        • MD5 SHA1 SHA512
        Submit Download

        nft.ico
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\nft.ico
        • Size 549B
        • SHA256 362864e9739a078b432344e22aee63cfd8f5f9eedb2b20bb367bf1c079e16879
        • MD5 SHA1 SHA512
        Submit Download

        pcn.pdf
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\pcn.pdf
        • Size 534B
        • SHA256 e0fc35258782b0ab991dfa8ff5f2eb49f77bc985d8c9816b004432f082c6848b
        • MD5 SHA1 SHA512
        Submit Download

        pex.xl
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\pex.xl
        • Size 507B
        • SHA256 f0820c8bc4911639e70e99295a68bbeff2cdf574fa8105947778f2625026484d
        • MD5 SHA1 SHA512
        Submit Download

        pic.xl
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\pic.xl
        • Size 587B
        • SHA256 33054e8b8ca6f02fcd817764d28bc6c22fb5440499bcac4bd48d6926fd68956b
        • MD5 SHA1 SHA512
        Submit Download

        pxr.xl
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\pxr.xl
        • Size 525B
        • SHA256 0f966965046d8ac36862159fbc35a54f6b7c3434ef3d3d4af70eaa06bf398314
        • MD5 SHA1 SHA512
        Submit Download

        qns.ico
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\qns.ico
        • Size 592B
        • SHA256 3bc61cf547f9981e6542ee55f71c461ff9d86c9599a2bf47f643179b39a20c6f
        • MD5 SHA1 SHA512
        Submit Download

        qnt.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\qnt.mp3
        • Size 583B
        • SHA256 2c9d72754ab5d38c99181180ad01fb9860d84457837674eb8a311ec2f3e29ab8
        • MD5 SHA1 SHA512
        Submit Download

        roi.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\roi.jpg
        • Size 514B
        • SHA256 101ffb3c89f5200b2c78a34e9a9c3c3d4794a73b343a557390d925122c2ddded
        • MD5 SHA1 SHA512
        Submit Download

        sdh.docx
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\sdh.docx
        • Size 599B
        • SHA256 7792dcf603d1499d0f2321c9f72d8b03b5e48f57b12a6e920279230749f868cd
        • MD5 SHA1 SHA512
        Submit Download

        sdk.exe
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\sdk.exe
        • Size 915KB
        • SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        slq.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\slq.jpg
        • Size 560B
        • SHA256 bf26ead67b108339763a267933d94161883a75f2e313c7f5b3ac2238288aa625
        • MD5 SHA1 SHA512
        Submit Download

        svi.icm
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\svi.icm
        • Size 544B
        • SHA256 06e1ac53bc8e9fcdab458003974cdbf6657b032a69444be1b15009e614fb0bfd
        • MD5 SHA1 SHA512
        Submit Download

        vqn.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\vqn.mp3
        • Size 558B
        • SHA256 24e74c28baf9a2f024e6cb908f8b20f760e61b91cd198cce65a4a5843895954c
        • MD5 SHA1 SHA512
        Submit Download

        wvv.icm
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\wvv.icm
        • Size 561B
        • SHA256 18aa6a208ec4d2f18eccac2d38cc3294bbd0cfb1ee6c5fb8233d0bd429a66abe
        • MD5 SHA1 SHA512
        Submit Download

        wwv.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\wwv.bmp
        • Size 566B
        • SHA256 08734a82bc4c398c665b23138769a70a6e20ecb48294f27487bedf4cd074627f
        • MD5 SHA1 SHA512
        Submit Download

        xng.dat
        • Path C:\Users\Admin\AppData\Local\Temp\14321638\xng.dat
        • Size 551B
        • SHA256 cde401e2a422f3bd9b51f84c2d12d96ee14a0d62fd319a694e969f78d7045522
        • MD5 SHA1 SHA512
        Submit Download

        memory/2120-148-0x0000000005B70000-0x0000000005B8E000-memory.dmp
        Download

        memory/2120-149-0x0000000005D90000-0x0000000005D9A000-memory.dmp
        Download

        memory/2120-147-0x0000000004EE0000-0x0000000004EEA000-memory.dmp
        Download

        memory/2120-145-0x0000000004E60000-0x0000000004E6A000-memory.dmp
        Download

        memory/2120-144-0x0000000004F20000-0x0000000004FBC000-memory.dmp
        Download

        memory/2120-143-0x0000000004DC0000-0x0000000004E52000-memory.dmp
        Download

        memory/2120-142-0x00000000054D0000-0x0000000005A74000-memory.dmp
        Download

        memory/2120-141-0x0000000000400000-0x0000000000438000-memory.dmp
        Download