Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 07:14
Static task
static1
Behavioral task
behavioral1
Sample
8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
8978c92506c07d5302ce6dc662f9f04a
-
SHA1
f428dc75757b74a4d4c5af2aead9c1632aadf1ab
-
SHA256
ecdffe05411786c5546a7c19ccedf2414ed6f504f8c21f2c9549b00fcd3c0a0f
-
SHA512
57e09ee7662110850d59f9a08093b6f309f03234b9f252ac491b73a1be3521e0a7f0764a597632332efb296944c741060015cd9692bdcc56e1d3abc55b0549c2
-
SSDEEP
24576:AtNzf/+vtSE3hY2mvb8ryQr1+0sPMeLVwhlDKQHp:qfG1S+z88+Qr1+0sPMeLG7f
Malware Config
Extracted
nanocore
1.2.2.0
213.226.147.73:54984
fda99c06-1575-4d54-814d-9fe92032a300
-
activate_away_mode
true
-
backup_connection_host
213.226.147.73
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2017-01-21T13:03:48.043104936Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fda99c06-1575-4d54-814d-9fe92032a300
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
213.226.147.73
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
WipeShadow.exeWipeShadow.exepid process 2404 WipeShadow.exe 2888 WipeShadow.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 776 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WipeShadow.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Subsystem = "C:\\Program Files (x86)\\LAN Subsystem\\lanss.exe" WipeShadow.exe -
Processes:
WipeShadow.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WipeShadow.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exeWipeShadow.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum WipeShadow.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 WipeShadow.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
WipeShadow.exedescription pid process target process PID 2404 set thread context of 2888 2404 WipeShadow.exe WipeShadow.exe -
Drops file in Program Files directory 2 IoCs
Processes:
WipeShadow.exedescription ioc process File created C:\Program Files (x86)\LAN Subsystem\lanss.exe WipeShadow.exe File opened for modification C:\Program Files (x86)\LAN Subsystem\lanss.exe WipeShadow.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
WipeShadow.exeWipeShadow.exeschtasks.exeschtasks.exe8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exeschtasks.exeschtasks.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WipeShadow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WipeShadow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 572 schtasks.exe 2688 schtasks.exe 1664 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exeWipeShadow.exeWipeShadow.exepid process 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe 2404 WipeShadow.exe 2404 WipeShadow.exe 2404 WipeShadow.exe 2404 WipeShadow.exe 2888 WipeShadow.exe 2888 WipeShadow.exe 2888 WipeShadow.exe 2888 WipeShadow.exe 2888 WipeShadow.exe 2888 WipeShadow.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WipeShadow.exepid process 2888 WipeShadow.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
WipeShadow.exepid process 2404 WipeShadow.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exeWipeShadow.exeWipeShadow.exedescription pid process Token: SeDebugPrivilege 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe Token: SeDebugPrivilege 2404 WipeShadow.exe Token: SeDebugPrivilege 2888 WipeShadow.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.execmd.exeWipeShadow.exeWipeShadow.exedescription pid process target process PID 2696 wrote to memory of 2760 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 2760 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 2760 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 2760 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 572 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 572 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 572 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 572 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe schtasks.exe PID 2696 wrote to memory of 776 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe cmd.exe PID 2696 wrote to memory of 776 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe cmd.exe PID 2696 wrote to memory of 776 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe cmd.exe PID 2696 wrote to memory of 776 2696 8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe cmd.exe PID 776 wrote to memory of 2404 776 cmd.exe WipeShadow.exe PID 776 wrote to memory of 2404 776 cmd.exe WipeShadow.exe PID 776 wrote to memory of 2404 776 cmd.exe WipeShadow.exe PID 776 wrote to memory of 2404 776 cmd.exe WipeShadow.exe PID 2404 wrote to memory of 2888 2404 WipeShadow.exe WipeShadow.exe PID 2404 wrote to memory of 2888 2404 WipeShadow.exe WipeShadow.exe PID 2404 wrote to memory of 2888 2404 WipeShadow.exe WipeShadow.exe PID 2404 wrote to memory of 2888 2404 WipeShadow.exe WipeShadow.exe PID 2404 wrote to memory of 2888 2404 WipeShadow.exe WipeShadow.exe PID 2888 wrote to memory of 2688 2888 WipeShadow.exe schtasks.exe PID 2888 wrote to memory of 2688 2888 WipeShadow.exe schtasks.exe PID 2888 wrote to memory of 2688 2888 WipeShadow.exe schtasks.exe PID 2888 wrote to memory of 2688 2888 WipeShadow.exe schtasks.exe PID 2888 wrote to memory of 1664 2888 WipeShadow.exe schtasks.exe PID 2888 wrote to memory of 1664 2888 WipeShadow.exe schtasks.exe PID 2888 wrote to memory of 1664 2888 WipeShadow.exe schtasks.exe PID 2888 wrote to memory of 1664 2888 WipeShadow.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8978c92506c07d5302ce6dc662f9f04a_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /TN "Update\4aa57bbc-7206-4ec5-aeea-8c7974e0194c" /F2⤵
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\4aa57bbc-7206-4ec5-aeea-8c7974e0194c" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1602942216.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:572 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /K "C:\Users\Admin\AppData\Roaming\WipeShadow.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Roaming\WipeShadow.exeC:\Users\Admin\AppData\Roaming\WipeShadow.exe3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Roaming\WipeShadow.exeC:\Users\Admin\AppData\Roaming\WipeShadow.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE14A.tmp"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2688 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE199.tmp"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1664
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51c45ac6cd1a2aa5562ed24f954831b60
SHA192cafd3951d3f5a69d29e857a57b7d1b1986d68c
SHA2569763ae2eaa58088e43894b8c5838ee9305e08f9205ccd39f65cb85f38ccad019
SHA512bd7c0ef5faa73821bcd9b7ba501903b35cdb4d10315cfeb1e5faea64d52f318e8e238de146462dc0770dc389b297bcbafcafe093388f7125d370abae19bcf883
-
Filesize
1KB
MD520707a2bbefb54c4338abff0b582a7ac
SHA1437f6821b31116249f9162d815c63ddff3f5238c
SHA2566b4487be8ac7880176a332acda683c433d0a01ddd8aec856928adebeec98bec7
SHA512f6d860fecbbb677062f1da72844370d72076d9483ba56b8c63d6ac8126d320621e04d007b38db750f4c6d43500f13a35cfabfd860196d5a0d9fd7467f2f7d814
-
Filesize
1KB
MD5924694e208642d4d8a4c7e0f0cba0de1
SHA187e9496a918036c3e3902f125b95a47e38548828
SHA2568de0bab59a9fe15f312e81a373382ed992ce5110deb3813f663b92cfc5eae0b6
SHA512ef3cfc08df53777f13fb51fdc0269f6f686c0df57c4dd72f395dc53d1d8ef2b08e33c3601507a45c3cc31a25b70ebf365d0fa93db64e1e851173216a45c49c2c
-
Filesize
1.2MB
MD58978c92506c07d5302ce6dc662f9f04a
SHA1f428dc75757b74a4d4c5af2aead9c1632aadf1ab
SHA256ecdffe05411786c5546a7c19ccedf2414ed6f504f8c21f2c9549b00fcd3c0a0f
SHA51257e09ee7662110850d59f9a08093b6f309f03234b9f252ac491b73a1be3521e0a7f0764a597632332efb296944c741060015cd9692bdcc56e1d3abc55b0549c2