Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 11:13
Static task
static1
Behavioral task
behavioral1
Sample
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe
-
Size
315KB
-
MD5
3d248944ca3304d6c97ab8b934c869d2
-
SHA1
04b032186ecd5b3099c54bd2eec6e8c7a5fdffff
-
SHA256
5b5a0f32647df552d3337225f9cb3467844987d1ffaeddcf190f524b097abc13
-
SHA512
8d556ada681e26418a06214725ebf5647035253b9085f1a3186171e162d8dd10d11d75c3cc943a562de526739556ff5ce83fdffb5017dd2261a83710ccd3342c
-
SSDEEP
6144:gf5yfbYDms7zY0U5T1tiXt7Mey/oRbw5o07L26:45dDmj55T1gZy/N5o0XJ
Malware Config
Extracted
nanocore
1.2.2.0
wumpwifi.onthewifi.com:2017
185.56.90.77:2017
023952f5-9a94-49ae-b9eb-3069891b2f3b
-
activate_away_mode
true
-
backup_connection_host
185.56.90.77
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-01-28T00:48:54.002261736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2017
-
default_group
Thai Beverage
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
023952f5-9a94-49ae-b9eb-3069891b2f3b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
wumpwifi.onthewifi.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Drops startup file 1 IoCs
Processes:
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skyppe update.exe.lnk 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 2128 svhost.exe -
Loads dropped DLL 3 IoCs
Processes:
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exepid process 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe -
Processes:
svhost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exedescription pid process target process PID 2700 set thread context of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exesvhost.exepid process 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2128 svhost.exe 2128 svhost.exe 2128 svhost.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svhost.exepid process 2128 svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exesvhost.exedescription pid process Token: SeDebugPrivilege 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe Token: SeDebugPrivilege 2128 svhost.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.execmd.exedescription pid process target process PID 2700 wrote to memory of 3012 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 3012 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 3012 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 3012 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 3012 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 3012 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 3012 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe cmd.exe PID 3012 wrote to memory of 2212 3012 cmd.exe reg.exe PID 3012 wrote to memory of 2212 3012 cmd.exe reg.exe PID 3012 wrote to memory of 2212 3012 cmd.exe reg.exe PID 3012 wrote to memory of 2212 3012 cmd.exe reg.exe PID 3012 wrote to memory of 2212 3012 cmd.exe reg.exe PID 3012 wrote to memory of 2212 3012 cmd.exe reg.exe PID 3012 wrote to memory of 2212 3012 cmd.exe reg.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe PID 2700 wrote to memory of 2128 2700 3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d248944ca3304d6c97ab8b934c869d2_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Skyppe\Skyppe update.exe.lnk" /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Skyppe\Skyppe update.exeFilesize
315KB
MD53d248944ca3304d6c97ab8b934c869d2
SHA104b032186ecd5b3099c54bd2eec6e8c7a5fdffff
SHA2565b5a0f32647df552d3337225f9cb3467844987d1ffaeddcf190f524b097abc13
SHA5128d556ada681e26418a06214725ebf5647035253b9085f1a3186171e162d8dd10d11d75c3cc943a562de526739556ff5ce83fdffb5017dd2261a83710ccd3342c
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
85KB
MD52e5f1cf69f92392f8829fc9c9263ae9b
SHA197b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA25651985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883
-
memory/2128-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2128-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2128-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2128-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2128-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2128-25-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2128-30-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2128-28-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2700-2-0x00000000748D0000-0x0000000074E7B000-memory.dmpFilesize
5.7MB
-
memory/2700-1-0x00000000748D0000-0x0000000074E7B000-memory.dmpFilesize
5.7MB
-
memory/2700-0-0x00000000748D1000-0x00000000748D2000-memory.dmpFilesize
4KB
-
memory/2700-35-0x00000000748D0000-0x0000000074E7B000-memory.dmpFilesize
5.7MB