Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 12:05
Static task
static1
Behavioral task
behavioral1
Sample
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
1b3c5144369e21c102063fc18adae793
-
SHA1
1390f21e61d7c52d967f5895ebf6e67ef4dbcff9
-
SHA256
b0deda9f8354364d78134de41f845a194f29dc6e24f6e68c6d959e2e518f3791
-
SHA512
ac76a7ccfaaf69fbfac7d4b564abeb19c9f3610488d085ef01309609f15ed643476c4b9193c7f095c935290d1293af0debae80cca98fbff576a2fc81ef1dcd7c
-
SSDEEP
24576:4a/ei0ZhOFpzx3UBgD3hqe/OqzsnvG3+XrJLHMZ2qWItqPTz:Yi0sFN1zMuCJLHn
Malware Config
Extracted
nanocore
1.2.2.0
queda2122.ddns.net:110
queda212.ddns.net:110
a59769ae-d88b-48a6-9aeb-eba13186dd16
-
activate_away_mode
true
-
backup_connection_host
queda212.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-05-01T17:12:48.076145036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
110
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a59769ae-d88b-48a6-9aeb-eba13186dd16
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
queda2122.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Drops startup file 2 IoCs
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silverlight.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silverlight.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Executes dropped EXE 4 IoCs
Processes:
svchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exesvchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exepid process 2040 svchost.exe 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 2984 svchost.exe 2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
Processes:
svchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exepid process 2040 svchost.exe 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exedescription pid process target process PID 2748 set thread context of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe -
Drops file in Windows directory 1 IoCs
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exedescription ioc process File created C:\Windows\svchost.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exepid process 2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exepid process 2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe Token: SeDebugPrivilege 2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
1b3c5144369e21c102063fc18adae793_JaffaCakes118.exesvchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exedescription pid process target process PID 1868 wrote to memory of 2040 1868 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe svchost.exe PID 1868 wrote to memory of 2040 1868 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe svchost.exe PID 1868 wrote to memory of 2040 1868 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe svchost.exe PID 1868 wrote to memory of 2040 1868 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe svchost.exe PID 2040 wrote to memory of 2748 2040 svchost.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2040 wrote to memory of 2748 2040 svchost.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2040 wrote to memory of 2748 2040 svchost.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2040 wrote to memory of 2748 2040 svchost.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe PID 2748 wrote to memory of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exeFilesize
1.1MB
MD57c1ff03d7f14a5eabd43873bb4971b5f
SHA1aca8440bef0d1b53d7b7396f7cb6b44891d4e9ef
SHA256d84feff4c109ae89c3712afd4454ec8a2e9171930cee71d665fd7bbe705b095e
SHA512e6d79aafc34567dc6057db11194bc6fcf9012e2eeb0373f695507339f05ca20ae8f5bf4460976d7f38731546110cfdd9798c883238f3ecaba37b07a63f7552fd
-
C:\Windows\svchost.exeFilesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
memory/1868-6-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2040-16-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/2560-30-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-46-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2560-38-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2560-37-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2560-36-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2560-33-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2560-35-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2748-20-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2748-26-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2748-24-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2748-22-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2748-21-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2748-40-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/2748-17-0x0000000074F51000-0x0000000074F52000-memory.dmpFilesize
4KB
-
memory/2984-25-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/2984-51-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB