Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe
-
Size
668KB
-
MD5
b36632b2009585727eaa83af6ba40124
-
SHA1
e53ea675d1ba0fc5e19ff6ddf35294c34e3c2fe0
-
SHA256
3428220d9ec39611487724fcf875972f2df6d7bb68108799a012630f3669611d
-
SHA512
71c977c27e54f5df83a7cd68e5a3c03be3043c60c6a78058690b2f8d291e1b63f1dd70a514828526f15cd15a6398cca596c9b518a980284442156c93727d6243
-
SSDEEP
12288:/SMDbiVo7FWoU8OEia8r+/ZS5TPhPJfQVYiwMoku56E9vsHbZv:/BtFE8Oi8r+/ZS5TPhPJfQV9wMokSuHZ
Malware Config
Extracted
nanocore
1.2.2.0
gifted.gleeze.com:55623
phill.onmypc.us:55623
5a8742ff-0185-4032-9522-375e8e036567
-
activate_away_mode
true
-
backup_connection_host
phill.onmypc.us
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-05-11T03:10:19.770910536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
55623
-
default_group
STUB
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5a8742ff-0185-4032-9522-375e8e036567
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
gifted.gleeze.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bin.exeb36632b2009585727eaa83af6ba40124_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation bin.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk bin.exe -
Executes dropped EXE 3 IoCs
Processes:
bin.exebin.exebin.exepid process 2716 bin.exe 3004 bin.exe 5068 bin.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1720-4-0x0000000005570000-0x00000000055A0000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" bin.exe -
Processes:
bin.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bin.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bin.exedescription pid process target process PID 2716 set thread context of 5068 2716 bin.exe bin.exe -
Drops file in Program Files directory 2 IoCs
Processes:
bin.exedescription ioc process File created C:\Program Files (x86)\DDP Service\ddpsv.exe bin.exe File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
bin.exebin.exepid process 2716 bin.exe 2716 bin.exe 2716 bin.exe 2716 bin.exe 5068 bin.exe 5068 bin.exe 5068 bin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
bin.exepid process 5068 bin.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exebin.exebin.exebin.exedescription pid process Token: SeDebugPrivilege 1720 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe Token: SeDebugPrivilege 2716 bin.exe Token: SeDebugPrivilege 3004 bin.exe Token: SeDebugPrivilege 5068 bin.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
b36632b2009585727eaa83af6ba40124_JaffaCakes118.exeexplorer.exebin.exedescription pid process target process PID 1720 wrote to memory of 1648 1720 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe cmd.exe PID 1720 wrote to memory of 1648 1720 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe cmd.exe PID 1720 wrote to memory of 1648 1720 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe cmd.exe PID 1720 wrote to memory of 3348 1720 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe explorer.exe PID 1720 wrote to memory of 3348 1720 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe explorer.exe PID 1720 wrote to memory of 3348 1720 b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe explorer.exe PID 3600 wrote to memory of 2716 3600 explorer.exe bin.exe PID 3600 wrote to memory of 2716 3600 explorer.exe bin.exe PID 3600 wrote to memory of 2716 3600 explorer.exe bin.exe PID 2716 wrote to memory of 3004 2716 bin.exe bin.exe PID 2716 wrote to memory of 3004 2716 bin.exe bin.exe PID 2716 wrote to memory of 3004 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe PID 2716 wrote to memory of 5068 2716 bin.exe bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\b36632b2009585727eaa83af6ba40124_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\bin.exe"2⤵PID:1648
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\bin.exe"2⤵PID:3348
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:81⤵PID:4620
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Users\Admin\AppData\Local\bin.exe"C:\Users\Admin\AppData\Local\bin.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\bin.exeFilesize
668KB
MD5b36632b2009585727eaa83af6ba40124
SHA1e53ea675d1ba0fc5e19ff6ddf35294c34e3c2fe0
SHA2563428220d9ec39611487724fcf875972f2df6d7bb68108799a012630f3669611d
SHA51271c977c27e54f5df83a7cd68e5a3c03be3043c60c6a78058690b2f8d291e1b63f1dd70a514828526f15cd15a6398cca596c9b518a980284442156c93727d6243
-
memory/1720-8-0x0000000074AD0000-0x0000000075280000-memory.dmpFilesize
7.7MB
-
memory/1720-7-0x0000000074ADE000-0x0000000074ADF000-memory.dmpFilesize
4KB
-
memory/1720-3-0x00000000054C0000-0x0000000005552000-memory.dmpFilesize
584KB
-
memory/1720-4-0x0000000005570000-0x00000000055A0000-memory.dmpFilesize
192KB
-
memory/1720-12-0x0000000074AD0000-0x0000000075280000-memory.dmpFilesize
7.7MB
-
memory/1720-6-0x0000000074AD0000-0x0000000075280000-memory.dmpFilesize
7.7MB
-
memory/1720-2-0x0000000005B20000-0x00000000060C4000-memory.dmpFilesize
5.6MB
-
memory/1720-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmpFilesize
4KB
-
memory/1720-5-0x00000000054B0000-0x00000000054B6000-memory.dmpFilesize
24KB
-
memory/1720-1-0x0000000000A80000-0x0000000000B2A000-memory.dmpFilesize
680KB
-
memory/2716-17-0x0000000008B70000-0x0000000008C0C000-memory.dmpFilesize
624KB
-
memory/5068-19-0x0000000000800000-0x0000000000838000-memory.dmpFilesize
224KB
-
memory/5068-20-0x0000000004D20000-0x0000000004D2A000-memory.dmpFilesize
40KB
-
memory/5068-23-0x0000000004FA0000-0x0000000004FAA000-memory.dmpFilesize
40KB
-
memory/5068-24-0x0000000005210000-0x000000000522E000-memory.dmpFilesize
120KB
-
memory/5068-25-0x0000000005230000-0x000000000523A000-memory.dmpFilesize
40KB