nanocore | 0e75c511b4041e2b662acbad9d02e021023fdca143750d89bdbf6c698fc092a4

Resubmissions

Analysis

max time kernel
147s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
Size

210KB
MD5

999056552fd5621272e7d13f206f38ff
SHA1

9ae5e27d559c2f651570dc048296b30e38ede4ff
SHA256

0e75c511b4041e2b662acbad9d02e021023fdca143750d89bdbf6c698fc092a4
SHA512

917c960fa5f44d20d72a00db353e820844df24c8795b8c8cbd8cd24b63dc8b37b42b2c2ca571d827555c10c6ca778b788f96c4cbfa6f4061a3dfde36f2535874
SSDEEP

3072:AzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIhGkU+V/vb6KjgQoVF8cBFDr6c:ALV6Bta6dtJmakIM5jh2/v9i/BOD+co

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4644 schtasks.exe

pid	process
4644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

pid	process
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

pid process

892 999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 892 999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description	pid	process	target process
PID 892 wrote to memory of 4644	892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe	schtasks.exe
PID 892 wrote to memory of 4644	892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe	schtasks.exe
PID 892 wrote to memory of 4644	892	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF770.tmp"
2⤵
- Creates scheduled task(s)
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
1⤵
PID:4772

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF770.tmp
Filesize
1KB

MD5
427d4f8e373308bac2f29cbaba78104c

SHA1
e1fb76ab43723ad5bfdedbf8cd273a69a8364ff3

SHA256
ca352f72d1555736723b4f3d9aa792a3ecad124a3ec0e551dc061fd347996f4b

SHA512
bb9171e461c2c015ce51392191023adb651636fb148a5732d330c554d589e29b6619efc4190595538baa0eff3af6d9ee3519b7264160f63f7c2a1fbbb2582a1c

Download Submit
memory/892-0-0x0000000075512000-0x0000000075513000-memory.dmp

Filesize
4KB

Download
memory/892-1-0x0000000075510000-0x0000000075AC1000-memory.dmp

Filesize
5.7MB

Download
memory/892-2-0x0000000075510000-0x0000000075AC1000-memory.dmp

Filesize
5.7MB

Download
memory/892-7-0x0000000075510000-0x0000000075AC1000-memory.dmp

Filesize
5.7MB

Download
memory/892-8-0x0000000075512000-0x0000000075513000-memory.dmp

Filesize
4KB

Download
memory/892-9-0x0000000075510000-0x0000000075AC1000-memory.dmp

Filesize
5.7MB

Download
memory/892-10-0x0000000075510000-0x0000000075AC1000-memory.dmp

Filesize
5.7MB

Download