Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 07:49
Static task
static1
Behavioral task
behavioral1
Sample
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe
-
Size
577KB
-
MD5
33dad009c342fd7c36dcd487924831af
-
SHA1
b63ee13bef92e529234265103634839a2268a011
-
SHA256
833329e27f6b61435fd495bc802a5a7b799b938214e6642dbc34d8c97d86e2b6
-
SHA512
f5bfa2043f2c41780f45334d624d422a877b1abdfa68d050ac46ad40faba36c955cfa0b05124a3efd32f9768a389cdce352f1565021540e7e97fa562530bc7ae
-
SSDEEP
12288:dKz6hGRiTGN4WNTBk6aVGplnfT3mp8Ea:FGN4WNOj6nz68
Malware Config
Extracted
nanocore
1.2.2.0
45.137.22.36:4837
vps.rootlayer.net:4837
a34ff911-f69f-4250-a136-9f7dda1ff095
-
activate_away_mode
true
-
backup_connection_host
vps.rootlayer.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-26T04:44:00.669256236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4837
-
default_group
root1
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
true
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
a34ff911-f69f-4250-a136-9f7dda1ff095
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
45.137.22.36
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exedescription pid process target process PID 2328 set thread context of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe33dad009c342fd7c36dcd487924831af_JaffaCakes118.exepid process 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 2308 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 2308 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exepid process 2308 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe33dad009c342fd7c36dcd487924831af_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe Token: SeDebugPrivilege 2308 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
33dad009c342fd7c36dcd487924831af_JaffaCakes118.exedescription pid process target process PID 2328 wrote to memory of 2652 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe schtasks.exe PID 2328 wrote to memory of 2652 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe schtasks.exe PID 2328 wrote to memory of 2652 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe schtasks.exe PID 2328 wrote to memory of 2652 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe schtasks.exe PID 2328 wrote to memory of 2320 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2320 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2320 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2320 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe PID 2328 wrote to memory of 2308 2328 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe 33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FCBlysHABADpq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp94D0.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33dad009c342fd7c36dcd487924831af_JaffaCakes118.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp94D0.tmpFilesize
1KB
MD5741e80b76dab7b2537d8fa2de58b1efd
SHA1c04b4c64f611fc611fca4ab0092b4c6db90ba823
SHA256497962baaf3fed453ca1358e5224a1346538e1687ea7689dfbad18ba83df1bac
SHA51277bd52c2dda058e4fec7e77b9dcda930b29cb76a84bc28c4b437f48238561f5988ea55eadd34f5af3f3675ddbd4aef95086bf191f0e94aa8875afa7f19b04a3f
-
memory/2308-25-0x0000000074820000-0x0000000074F0E000-memory.dmpFilesize
6.9MB
-
memory/2308-12-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-14-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-30-0x0000000074820000-0x0000000074F0E000-memory.dmpFilesize
6.9MB
-
memory/2308-29-0x0000000000450000-0x000000000045A000-memory.dmpFilesize
40KB
-
memory/2308-28-0x00000000004A0000-0x00000000004BE000-memory.dmpFilesize
120KB
-
memory/2308-24-0x0000000074820000-0x0000000074F0E000-memory.dmpFilesize
6.9MB
-
memory/2308-13-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2308-27-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/2308-31-0x0000000074820000-0x0000000074F0E000-memory.dmpFilesize
6.9MB
-
memory/2308-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2308-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2328-1-0x0000000000900000-0x0000000000996000-memory.dmpFilesize
600KB
-
memory/2328-23-0x0000000074820000-0x0000000074F0E000-memory.dmpFilesize
6.9MB
-
memory/2328-0-0x000000007482E000-0x000000007482F000-memory.dmpFilesize
4KB
-
memory/2328-3-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/2328-2-0x0000000074820000-0x0000000074F0E000-memory.dmpFilesize
6.9MB
-
memory/2328-6-0x00000000050F0000-0x0000000005152000-memory.dmpFilesize
392KB
-
memory/2328-5-0x0000000074820000-0x0000000074F0E000-memory.dmpFilesize
6.9MB
-
memory/2328-4-0x000000007482E000-0x000000007482F000-memory.dmpFilesize
4KB