Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 22:47
Behavioral task
behavioral1
Sample
92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe
-
Size
508KB
-
MD5
92dee88250716a1b84069e41c47d342e
-
SHA1
b16fbfb6a7338d546abcd1e4215d611ac7d148fe
-
SHA256
8faf173504f963edc3bf79873db39d9b8be858b8f39adeadda7ed54f618a6719
-
SHA512
94f7e3f4cb003822f4144df6fc59da4fc5aa087111c00157f26b5a061c07655d5adb82e708807fc32fb8d7c2703e4ad5d94d6d00c02bff6b56cc6c06984cf148
-
SSDEEP
6144:Z3F48TZj4P9miwZWCJPd3ZWfysc3yFEPfN+fs10RZfaCrdYm:o21iShdJWKV3yFEPfN+UuZf
Malware Config
Extracted
nanocore
1.2.2.0
zouina1.ddnsfree.com:9191
b2ae6bf7-ff72-4f89-86db-259e08f05aeb
-
activate_away_mode
true
-
backup_connection_host
zouina1.ddnsfree.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-10T15:55:47.848866436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9191
-
default_group
Room1
-
enable_debug_mode
true
-
gc_threshold
1.0485748e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b2ae6bf7-ff72-4f89-86db-259e08f05aeb
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
zouina1.ddnsfree.com
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 2676 RegAsm.exe -
Loads dropped DLL 2 IoCs
Processes:
92dee88250716a1b84069e41c47d342e_JaffaCakes118.exeRegAsm.exepid process 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe 2676 RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
92dee88250716a1b84069e41c47d342e_JaffaCakes118.exedescription pid process target process PID 1872 set thread context of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\ARP Host\arphost.exe RegAsm.exe File opened for modification C:\Program Files (x86)\ARP Host\arphost.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2444 1872 WerFault.exe 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2256 schtasks.exe 832 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
92dee88250716a1b84069e41c47d342e_JaffaCakes118.exeRegAsm.exepid process 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe 2676 RegAsm.exe 2676 RegAsm.exe 2676 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 2676 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
92dee88250716a1b84069e41c47d342e_JaffaCakes118.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe Token: SeDebugPrivilege 2676 RegAsm.exe Token: SeDebugPrivilege 2676 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
92dee88250716a1b84069e41c47d342e_JaffaCakes118.exeRegAsm.exedescription pid process target process PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2676 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe RegAsm.exe PID 1872 wrote to memory of 2444 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe WerFault.exe PID 1872 wrote to memory of 2444 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe WerFault.exe PID 1872 wrote to memory of 2444 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe WerFault.exe PID 1872 wrote to memory of 2444 1872 92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe WerFault.exe PID 2676 wrote to memory of 2256 2676 RegAsm.exe schtasks.exe PID 2676 wrote to memory of 2256 2676 RegAsm.exe schtasks.exe PID 2676 wrote to memory of 2256 2676 RegAsm.exe schtasks.exe PID 2676 wrote to memory of 2256 2676 RegAsm.exe schtasks.exe PID 2676 wrote to memory of 832 2676 RegAsm.exe schtasks.exe PID 2676 wrote to memory of 832 2676 RegAsm.exe schtasks.exe PID 2676 wrote to memory of 832 2676 RegAsm.exe schtasks.exe PID 2676 wrote to memory of 832 2676 RegAsm.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\92dee88250716a1b84069e41c47d342e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC948.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC9B6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 7802⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC948.tmpFilesize
1KB
MD54cd7da0133ff64f40216341d95fe30bb
SHA188146cfd7754b988f50e929d876f33dc9916758f
SHA25637cce77e24a3c3d5ab28c16f726ef6a62c553acd972e256927f69064c4e1cfde
SHA512fa5b84f207fd9f20b2eace6cda9124e9d718fc80dc0a5fab31507f372d15ba69e1098a26e2e7036ba559ca52a99cfd804ca99ba68bda0a60386a33197722df8f
-
C:\Users\Admin\AppData\Local\Temp\tmpC9B6.tmpFilesize
1KB
MD5447ab194ab36cb1d20078d80e502b1b2
SHA1a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0
SHA2568d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5
SHA51249ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327
-
\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
memory/1872-1-0x0000000000CC0000-0x0000000000D46000-memory.dmpFilesize
536KB
-
memory/1872-2-0x00000000005C0000-0x00000000005E0000-memory.dmpFilesize
128KB
-
memory/1872-3-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1872-4-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1872-5-0x0000000000600000-0x000000000060A000-memory.dmpFilesize
40KB
-
memory/1872-6-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1872-8-0x0000000000A40000-0x0000000000A4A000-memory.dmpFilesize
40KB
-
memory/1872-40-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1872-0-0x000000007423E000-0x000000007423F000-memory.dmpFilesize
4KB
-
memory/2676-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2676-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2676-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2676-26-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2676-27-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2676-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2676-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2676-37-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/2676-38-0x00000000004F0000-0x000000000050E000-memory.dmpFilesize
120KB
-
memory/2676-39-0x0000000000870000-0x000000000087A000-memory.dmpFilesize
40KB
-
memory/2676-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB