Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 16:41
Static task
static1
Behavioral task
behavioral1
Sample
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe
-
Size
641KB
-
MD5
09a8ee07ff8bcdd18f3bc237f6e19c06
-
SHA1
04300a793662035c7ef696e83a9bf6eb30c4e6b9
-
SHA256
3a15d1f531ee5efd3d82e8ebac4ea5fb8277c002f73d3781ec648cf9c65c39ef
-
SHA512
8416d6c77c12fb09390a0b6686e88c81bdd458213f8c7192587e24476efaf9a3a227e42ea1a9d866af767fbb14b80c6c3a66f818caa6b8d45c21fc56a5a91f3b
-
SSDEEP
12288:6OkpGIqQImAu1BEfLDxKlQMZWDT4x+2zXK2xp:GwqIvuBEfYl/ZsT4E2z62
Malware Config
Extracted
nanocore
1.2.2.0
strongodss.ddns.net:58103
79.134.225.43:58103
572eb7a9-aedf-4b39-8669-f7563dab8a38
-
activate_away_mode
false
-
backup_connection_host
79.134.225.43
- backup_dns_server
-
buffer_size
65538
-
build_time
2020-08-31T08:01:57.275180636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
58103
-
default_group
GREAT
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
572eb7a9-aedf-4b39-8669-f7563dab8a38
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
strongodss.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe" RegSvcs.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription pid process target process PID 2040 set thread context of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\TCP Subsystem\tcpss.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\TCP Subsystem\tcpss.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2732 schtasks.exe 2268 schtasks.exe 2596 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exeRegSvcs.exepid process 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe 2428 RegSvcs.exe 2428 RegSvcs.exe 2428 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 2428 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe Token: SeDebugPrivilege 2428 RegSvcs.exe Token: SeDebugPrivilege 2428 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 2040 wrote to memory of 2732 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe schtasks.exe PID 2040 wrote to memory of 2732 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe schtasks.exe PID 2040 wrote to memory of 2732 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe schtasks.exe PID 2040 wrote to memory of 2732 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe schtasks.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2040 wrote to memory of 2428 2040 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 2428 wrote to memory of 2268 2428 RegSvcs.exe schtasks.exe PID 2428 wrote to memory of 2268 2428 RegSvcs.exe schtasks.exe PID 2428 wrote to memory of 2268 2428 RegSvcs.exe schtasks.exe PID 2428 wrote to memory of 2268 2428 RegSvcs.exe schtasks.exe PID 2428 wrote to memory of 2596 2428 RegSvcs.exe schtasks.exe PID 2428 wrote to memory of 2596 2428 RegSvcs.exe schtasks.exe PID 2428 wrote to memory of 2596 2428 RegSvcs.exe schtasks.exe PID 2428 wrote to memory of 2596 2428 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QYQmEmZh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp900F.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2732 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp91F3.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2268 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9261.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2596
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp900F.tmpFilesize
1KB
MD517114b06a27aea4873efbc15498f3c48
SHA19ed6831d93e2782e0b65cec4564b73d6d119f003
SHA256ca0269a96097c244df29b94961007634fe4ff1dcb8585555c0114979cde9fe6e
SHA5120c45630f442090d35882e7e72ea9efe8ef79970993b0a252c1a229ab99c7c9203f8e1fa7d9e1adfaf27d367ccf0dc89e9dfa5d28781622dc588cac6595ef4e47
-
C:\Users\Admin\AppData\Local\Temp\tmp91F3.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmp9261.tmpFilesize
1KB
MD54b7ef560289c0f62d0baf6f14f48a57a
SHA18331acb90dde588aa3196919f6e847f398fd06d1
SHA256062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
SHA512ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8
-
memory/2040-23-0x0000000074A60000-0x000000007500B000-memory.dmpFilesize
5.7MB
-
memory/2040-1-0x0000000074A60000-0x000000007500B000-memory.dmpFilesize
5.7MB
-
memory/2040-2-0x0000000074A60000-0x000000007500B000-memory.dmpFilesize
5.7MB
-
memory/2040-3-0x0000000074A60000-0x000000007500B000-memory.dmpFilesize
5.7MB
-
memory/2040-4-0x0000000074A60000-0x000000007500B000-memory.dmpFilesize
5.7MB
-
memory/2040-0-0x0000000074A61000-0x0000000074A62000-memory.dmpFilesize
4KB
-
memory/2428-14-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2428-22-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2428-20-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2428-18-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2428-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2428-8-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2428-12-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2428-10-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB