Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 22:11
Static task
static1
Behavioral task
behavioral1
Sample
b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe
-
Size
1013KB
-
MD5
b05c46f14ddf7ebfaab396f9f540787e
-
SHA1
ca2f0b7950ac3697e672c98190eb04f386e65ac3
-
SHA256
5f5e91ec90f4e5afb30a76069d2e3036247b15d79a10d8561dc9856e3854b3c0
-
SHA512
f19d16c7545718bc5e27dea8249478f703d1cea905dbbbd0678825c67c34beb9d1c2060502075765e5545c536ecf5450f7b62d4bd390a04a9e88f7b7a4e5ddb4
-
SSDEEP
24576:HHSSMkz9i+LFsxkrxiLMQQ6LPAshFiFeH1:HH9B5Cxk9JeH1
Malware Config
Extracted
nanocore
1.2.2.0
tallboy.zapto.org:2669
721e5ca6-2a7d-4e47-90be-697197d2647d
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2017-05-09T08:28:08.263783636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2669
-
default_group
PM
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
721e5ca6-2a7d-4e47-90be-697197d2647d
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
tallboy.zapto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\dtfdygfuhh\\tfghjuku.exe" b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe -
Processes:
regasm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA regasm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exedescription pid process target process PID 2452 set thread context of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 set thread context of 2816 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe notepad.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 2816 notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exeregasm.exenotepad.exepid process 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe 2124 regasm.exe 2124 regasm.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe 2816 notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regasm.exepid process 2124 regasm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regasm.exedescription pid process Token: SeDebugPrivilege 2124 regasm.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exedescription pid process target process PID 2452 wrote to memory of 1192 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 1192 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 1192 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 1192 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 1192 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 1192 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 1192 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2124 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe regasm.exe PID 2452 wrote to memory of 2816 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe notepad.exe PID 2452 wrote to memory of 2816 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe notepad.exe PID 2452 wrote to memory of 2816 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe notepad.exe PID 2452 wrote to memory of 2816 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe notepad.exe PID 2452 wrote to memory of 2816 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe notepad.exe PID 2452 wrote to memory of 2816 2452 b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b05c46f14ddf7ebfaab396f9f540787e_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"2⤵PID:1192
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Windows\SysWOW64\notepad.exepersistencecmd 0 "C:\Users\Admin\AppData\Roaming\dtfdygfuhh\tfghjuku.exe"2⤵
- Opens file in notepad (likely ransom note)
- Suspicious behavior: EnumeratesProcesses
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2124-16-0x0000000074972000-0x0000000074974000-memory.dmpFilesize
8KB
-
memory/2124-6-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2124-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2124-21-0x0000000074972000-0x0000000074974000-memory.dmpFilesize
8KB
-
memory/2124-3-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2124-23-0x0000000000AB0000-0x0000000000AF0000-memory.dmpFilesize
256KB
-
memory/2124-19-0x0000000000AB0000-0x0000000000AF0000-memory.dmpFilesize
256KB
-
memory/2452-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2452-11-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2452-1-0x0000000003170000-0x0000000003265000-memory.dmpFilesize
980KB
-
memory/2452-14-0x0000000003170000-0x0000000003265000-memory.dmpFilesize
980KB
-
memory/2816-9-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2816-10-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2816-17-0x0000000003150000-0x0000000003245000-memory.dmpFilesize
980KB
-
memory/2816-15-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2816-20-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2816-13-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2816-22-0x0000000003150000-0x0000000003245000-memory.dmpFilesize
980KB
-
memory/2816-12-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB