General
-
Target
85ab2898cb89505c95021511b1cc04ad_JaffaCakes118
-
Size
953KB
-
Sample
240531-cefc7scc44
-
MD5
85ab2898cb89505c95021511b1cc04ad
-
SHA1
e2813e59a5061b26071968546d3a2e229184afe0
-
SHA256
f08a007d5bb495d7caf8ce9a3244438e11edb3f2d44df754cb53526d78992172
-
SHA512
1416f61117d8180c7ade6a47148256869a82362e6f8b5a5db60ddb25bc6ffcf74ea6a5798cf29452d915b200e5a2b67ea09e7f0ad63b49bbd00ec0c9f15d571e
-
SSDEEP
24576:92O/GltkwWhpEO4BZPKOnrG89C51wfwmxhKbH3rUO46GIM:lI768sQwmxUT3iAM
Static task
static1
Behavioral task
behavioral1
Sample
85ab2898cb89505c95021511b1cc04ad_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
nanocore
1.2.2.0
franex.sytes.net:19055
franexserve.duckdns.org:19055
b419eeae-0d79-4132-aae3-286d9a62a602
-
activate_away_mode
true
-
backup_connection_host
franexserve.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-08-08T22:26:34.089187836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
19055
-
default_group
franex
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b419eeae-0d79-4132-aae3-286d9a62a602
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
franex.sytes.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
85ab2898cb89505c95021511b1cc04ad_JaffaCakes118
-
Size
953KB
-
MD5
85ab2898cb89505c95021511b1cc04ad
-
SHA1
e2813e59a5061b26071968546d3a2e229184afe0
-
SHA256
f08a007d5bb495d7caf8ce9a3244438e11edb3f2d44df754cb53526d78992172
-
SHA512
1416f61117d8180c7ade6a47148256869a82362e6f8b5a5db60ddb25bc6ffcf74ea6a5798cf29452d915b200e5a2b67ea09e7f0ad63b49bbd00ec0c9f15d571e
-
SSDEEP
24576:92O/GltkwWhpEO4BZPKOnrG89C51wfwmxhKbH3rUO46GIM:lI768sQwmxUT3iAM
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-