nanocore | 0e75c511b4041e2b662acbad9d02e021023fdca143750d89bdbf6c698fc092a4

Resubmissions

Analysis

max time kernel
119s
max time network
117s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06-06-2024 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
Size

210KB
MD5

999056552fd5621272e7d13f206f38ff
SHA1

9ae5e27d559c2f651570dc048296b30e38ede4ff
SHA256

0e75c511b4041e2b662acbad9d02e021023fdca143750d89bdbf6c698fc092a4
SHA512

917c960fa5f44d20d72a00db353e820844df24c8795b8c8cbd8cd24b63dc8b37b42b2c2ca571d827555c10c6ca778b788f96c4cbfa6f4061a3dfde36f2535874
SSDEEP

3072:AzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIhGkU+V/vb6KjgQoVF8cBFDr6c:ALV6Bta6dtJmakIM5jh2/v9i/BOD+co

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1256 schtasks.exe

pid	process
1256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

pid	process
4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

pid process

4296 999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4296 999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe

description	pid	process	target process
PID 4296 wrote to memory of 1256	4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe	schtasks.exe
PID 4296 wrote to memory of 1256	4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe	schtasks.exe
PID 4296 wrote to memory of 1256	4296	999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\999056552fd5621272e7d13f206f38ff_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "PCI Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6542.tmp"
2⤵
- Creates scheduled task(s)
PID:1256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6542.tmp
Filesize
1KB

MD5
427d4f8e373308bac2f29cbaba78104c

SHA1
e1fb76ab43723ad5bfdedbf8cd273a69a8364ff3

SHA256
ca352f72d1555736723b4f3d9aa792a3ecad124a3ec0e551dc061fd347996f4b

SHA512
bb9171e461c2c015ce51392191023adb651636fb148a5732d330c554d589e29b6619efc4190595538baa0eff3af6d9ee3519b7264160f63f7c2a1fbbb2582a1c

Download Submit
memory/4296-0-0x00000000736B1000-0x00000000736B2000-memory.dmp

Filesize
4KB

Download
memory/4296-1-0x00000000736B0000-0x0000000073C60000-memory.dmp

Filesize
5.7MB

Download
memory/4296-2-0x00000000736B0000-0x0000000073C60000-memory.dmp

Filesize
5.7MB

Download
memory/4296-7-0x00000000736B0000-0x0000000073C60000-memory.dmp

Filesize
5.7MB

Download
memory/4296-8-0x00000000736B0000-0x0000000073C60000-memory.dmp

Filesize
5.7MB

Download