Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe
-
Size
668KB
-
MD5
b36632b2009585727eaa83af6ba40124
-
SHA1
e53ea675d1ba0fc5e19ff6ddf35294c34e3c2fe0
-
SHA256
3428220d9ec39611487724fcf875972f2df6d7bb68108799a012630f3669611d
-
SHA512
71c977c27e54f5df83a7cd68e5a3c03be3043c60c6a78058690b2f8d291e1b63f1dd70a514828526f15cd15a6398cca596c9b518a980284442156c93727d6243
-
SSDEEP
12288:/SMDbiVo7FWoU8OEia8r+/ZS5TPhPJfQVYiwMoku56E9vsHbZv:/BtFE8Oi8r+/ZS5TPhPJfQV9wMokSuHZ
Malware Config
Extracted
nanocore
1.2.2.0
gifted.gleeze.com:55623
phill.onmypc.us:55623
5a8742ff-0185-4032-9522-375e8e036567
-
activate_away_mode
true
-
backup_connection_host
phill.onmypc.us
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-05-11T03:10:19.770910536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
55623
-
default_group
STUB
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a8742ff-0185-4032-9522-375e8e036567
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
gifted.gleeze.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Drops startup file 1 IoCs
Processes:
bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk bin.exe -
Executes dropped EXE 3 IoCs
Processes:
bin.exebin.exebin.exepid process 2972 bin.exe 2044 bin.exe 2296 bin.exe -
Loads dropped DLL 1 IoCs
Processes:
bin.exepid process 2972 bin.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2344-2-0x00000000003D0000-0x0000000000400000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" bin.exe -
Processes:
bin.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bin.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bin.exedescription pid process target process PID 2972 set thread context of 2296 2972 bin.exe bin.exe -
Drops file in Program Files directory 2 IoCs
Processes:
bin.exedescription ioc process File created C:\Program Files (x86)\TCP Service\tcpsv.exe bin.exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
bin.exebin.exepid process 2972 bin.exe 2972 bin.exe 2972 bin.exe 2296 bin.exe 2296 bin.exe 2296 bin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
bin.exepid process 2296 bin.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exebin.exebin.exebin.exedescription pid process Token: SeDebugPrivilege 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe Token: SeDebugPrivilege 2972 bin.exe Token: SeDebugPrivilege 2044 bin.exe Token: SeDebugPrivilege 2296 bin.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exeexplorer.exebin.exedescription pid process target process PID 2344 wrote to memory of 2668 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe cmd.exe PID 2344 wrote to memory of 2668 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe cmd.exe PID 2344 wrote to memory of 2668 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe cmd.exe PID 2344 wrote to memory of 2668 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe cmd.exe PID 2344 wrote to memory of 2524 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe explorer.exe PID 2344 wrote to memory of 2524 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe explorer.exe PID 2344 wrote to memory of 2524 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe explorer.exe PID 2344 wrote to memory of 2524 2344 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe explorer.exe PID 2096 wrote to memory of 2972 2096 explorer.exe bin.exe PID 2096 wrote to memory of 2972 2096 explorer.exe bin.exe PID 2096 wrote to memory of 2972 2096 explorer.exe bin.exe PID 2096 wrote to memory of 2972 2096 explorer.exe bin.exe PID 2972 wrote to memory of 2044 2972 bin.exe bin.exe PID 2972 wrote to memory of 2044 2972 bin.exe bin.exe PID 2972 wrote to memory of 2044 2972 bin.exe bin.exe PID 2972 wrote to memory of 2044 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe PID 2972 wrote to memory of 2296 2972 bin.exe bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\bin.exe"2⤵PID:2668
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\bin.exe"2⤵PID:2524
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\bin.exeFilesize
668KB
MD5b36632b2009585727eaa83af6ba40124
SHA1e53ea675d1ba0fc5e19ff6ddf35294c34e3c2fe0
SHA2563428220d9ec39611487724fcf875972f2df6d7bb68108799a012630f3669611d
SHA51271c977c27e54f5df83a7cd68e5a3c03be3043c60c6a78058690b2f8d291e1b63f1dd70a514828526f15cd15a6398cca596c9b518a980284442156c93727d6243
-
memory/2296-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2296-34-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/2296-33-0x0000000000440000-0x000000000045E000-memory.dmpFilesize
120KB
-
memory/2296-32-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/2296-29-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2296-28-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2296-26-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2296-23-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2296-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2296-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2296-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2344-5-0x0000000074060000-0x000000007474E000-memory.dmpFilesize
6.9MB
-
memory/2344-10-0x0000000074060000-0x000000007474E000-memory.dmpFilesize
6.9MB
-
memory/2344-7-0x0000000074060000-0x000000007474E000-memory.dmpFilesize
6.9MB
-
memory/2344-6-0x000000007406E000-0x000000007406F000-memory.dmpFilesize
4KB
-
memory/2344-0-0x000000007406E000-0x000000007406F000-memory.dmpFilesize
4KB
-
memory/2344-4-0x0000000074060000-0x000000007474E000-memory.dmpFilesize
6.9MB
-
memory/2344-3-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/2344-2-0x00000000003D0000-0x0000000000400000-memory.dmpFilesize
192KB
-
memory/2344-1-0x0000000001310000-0x00000000013BA000-memory.dmpFilesize
680KB
-
memory/2972-13-0x0000000000AA0000-0x0000000000B4A000-memory.dmpFilesize
680KB