Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 21:52
Static task
static1
Behavioral task
behavioral1
Sample
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
820f6dd9860bebd89fd0374f70e436be
-
SHA1
1b75b8179f090063902b13281543c1367fef4081
-
SHA256
672316bdeef6fa3c30828452e67394ce0b6e160e51e70a1c97f40db377c8aac0
-
SHA512
f4c5e07ae0e027df7f6bd16a9d68768bfd45515a91cbe0d0ca5eb81435bd25205a592ef3984790223f8ce52f0985f040fde216d7e315201bfa7743d7de023388
-
SSDEEP
6144:rgLcb/d7rFFjZsvsZHV/jmVx4Z9zvmQVOelREPXvg+/oFyLaiQOKDaM:Uadf2UZHV/jmavBXsIy+dOW
Malware Config
Extracted
nanocore
1.2.2.0
irofualauzo1.ddns.net:3535
212.7.218.47:3535
66a931c5-34de-482d-832d-b4d5ec5fea87
-
activate_away_mode
true
-
backup_connection_host
212.7.218.47
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2017-09-20T09:51:51.650276436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3535
-
default_group
CASHOUT
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
66a931c5-34de-482d-832d-b4d5ec5fea87
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
irofualauzo1.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Drops startup file 1 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cashout.exe.lnk 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Host = "C:\\Program Files (x86)\\DHCP Host\\dhcphost.exe" 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exedescription pid process target process PID 1676 set thread context of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\DHCP Host\dhcphost.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\DHCP Host\dhcphost.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2672 timeout.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\grace\cashout.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exepid process 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 2564 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 2564 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 2564 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exepid process 2564 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe Token: SeDebugPrivilege 2564 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 1676 wrote to memory of 2756 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 1676 wrote to memory of 2756 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 1676 wrote to memory of 2756 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 1676 wrote to memory of 2756 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 2756 wrote to memory of 2980 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2980 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2980 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2980 2756 cmd.exe reg.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2564 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe PID 1676 wrote to memory of 2576 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 1676 wrote to memory of 2576 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 1676 wrote to memory of 2576 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 1676 wrote to memory of 2576 1676 820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe cmd.exe PID 2576 wrote to memory of 2672 2576 cmd.exe timeout.exe PID 2576 wrote to memory of 2672 2576 cmd.exe timeout.exe PID 2576 wrote to memory of 2672 2576 cmd.exe timeout.exe PID 2576 wrote to memory of 2672 2576 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\grace\cashout.exe.lnk" /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\820f6dd9860bebd89fd0374f70e436be_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\grace\cashout.exe.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\grace\cashout.exeFilesize
1.4MB
MD5820f6dd9860bebd89fd0374f70e436be
SHA11b75b8179f090063902b13281543c1367fef4081
SHA256672316bdeef6fa3c30828452e67394ce0b6e160e51e70a1c97f40db377c8aac0
SHA512f4c5e07ae0e027df7f6bd16a9d68768bfd45515a91cbe0d0ca5eb81435bd25205a592ef3984790223f8ce52f0985f040fde216d7e315201bfa7743d7de023388
-
C:\Users\Admin\AppData\Roaming\grace\cashout.exe.batFilesize
202B
MD5d592662cb38e0e99d15afe9115097779
SHA18544f5f0854f4c0eafcf4c1396b13f7f81682b9f
SHA2568960caea9115579f3b9706cfe72b898622348fc95490943424e9040dc98412e8
SHA51267809225b002a68cc0514f6fc17b1bccdf1fccc213b9c89f6c8cb9793522f489a9c7be2c322b676541ccda76b8811ef078cdc7b33e0b62ea47430f0c8a2f16c7
-
memory/1676-0-0x0000000074941000-0x0000000074942000-memory.dmpFilesize
4KB
-
memory/1676-1-0x0000000074940000-0x0000000074EEB000-memory.dmpFilesize
5.7MB
-
memory/1676-2-0x0000000074940000-0x0000000074EEB000-memory.dmpFilesize
5.7MB
-
memory/1676-38-0x0000000074940000-0x0000000074EEB000-memory.dmpFilesize
5.7MB
-
memory/2564-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2564-24-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2564-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2564-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2564-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2564-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2564-25-0x0000000074940000-0x0000000074EEB000-memory.dmpFilesize
5.7MB
-
memory/2564-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2564-26-0x0000000074940000-0x0000000074EEB000-memory.dmpFilesize
5.7MB
-
memory/2564-36-0x0000000074940000-0x0000000074EEB000-memory.dmpFilesize
5.7MB
-
memory/2564-10-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2564-39-0x0000000074940000-0x0000000074EEB000-memory.dmpFilesize
5.7MB