Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 11:45
Static task
static1
Behavioral task
behavioral1
Sample
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe
-
Size
410KB
-
MD5
ae45ec757612c255a5e1a0e42e7f83f1
-
SHA1
0f8bf3bf3160c3ed958c0d628e453ee256de04d1
-
SHA256
abc86a30c916c9a2531c12335b85fd23202cdd8f59f3a273d325f9f585128606
-
SHA512
e7419390bad61d5e99effc26c80632c006d5f8cea5589719dde812020d17603473df132c019ae5efb33709eb13563cc2ae7bcbf1744da790d54d990a68ec70e7
-
SSDEEP
12288:pZTIwkezi3SI92iNo7pW4vFLkBXi8ELdyrheY0S:e3h91e44NL2i8EwNNL
Malware Config
Extracted
nanocore
1.2.2.0
moregrace.duckdns.org:443
cd320ca4-767a-4eb5-b115-620d2b011f74
-
activate_away_mode
true
-
backup_connection_host
moregrace.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-02T00:59:50.651896936Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
443
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
cd320ca4-767a-4eb5-b115-620d2b011f74
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
moregrace.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exedescription pid process target process PID 3056 set thread context of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1916 schtasks.exe 3708 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exeMSBuild.exepid process 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe 3520 MSBuild.exe 3520 MSBuild.exe 3520 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 3520 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe Token: SeDebugPrivilege 3520 MSBuild.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exeMSBuild.exedescription pid process target process PID 3056 wrote to memory of 1916 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe schtasks.exe PID 3056 wrote to memory of 1916 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe schtasks.exe PID 3056 wrote to memory of 1916 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe schtasks.exe PID 3056 wrote to memory of 4008 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 4008 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 4008 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 2684 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 2684 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 2684 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3056 wrote to memory of 3520 3056 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 3520 wrote to memory of 3708 3520 MSBuild.exe schtasks.exe PID 3520 wrote to memory of 3708 3520 MSBuild.exe schtasks.exe PID 3520 wrote to memory of 3708 3520 MSBuild.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IcyOBKPuqiF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C7E.tmp"2⤵
- Creates scheduled task(s)
PID:1916 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵PID:4008
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵PID:2684
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8028.tmp"3⤵
- Creates scheduled task(s)
PID:3708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4376,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:81⤵PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7C7E.tmpFilesize
1KB
MD5573c008721a0eb26b6d1b449688d0a4c
SHA133b9da5c2c87bc471a2dc10948783a25fda1a8e1
SHA2563bf6999888e5568e027acb2571d59d8db05a8e3dd3977eeb123ba4d4063e82fd
SHA5127e10f4066a09e1e73ee9bfbce1cfef25270d6d8a36c790644a7f0711be62c8f8ab0f90dfc5cda0717635f1a7f1fe35727c8abf70cac8d4ea35ee232be9c5abb9
-
C:\Users\Admin\AppData\Local\Temp\tmp8028.tmpFilesize
1KB
MD5ae766004c0d8792953bafffe8f6a2e3b
SHA114b12f27543a401e2fe0af8052e116cab0032426
SHA2561abdd9b6a6b84e4ba1af1282dc84ce276c59ba253f4c4af05fea498a4fd99540
SHA512e530da4a5d4336fc37838d0e93b5eb3804b9c489c71f6954a47fc81a4c655bb72ec493e109cf96e6e3617d7623ac80697ad3bbd5ffc6281bafc8b34dca5e6567
-
memory/3056-3-0x0000000074E82000-0x0000000074E83000-memory.dmpFilesize
4KB
-
memory/3056-0-0x0000000074E82000-0x0000000074E83000-memory.dmpFilesize
4KB
-
memory/3056-4-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3056-2-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3056-1-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3056-17-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3520-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3520-10-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3520-11-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3520-16-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3520-18-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3520-19-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB