Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 10:12
Static task
static1
Behavioral task
behavioral1
Sample
95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe
-
Size
458KB
-
MD5
95a92cb1e2eb45772520a4ead4f0c238
-
SHA1
af46b72a1bc9ced93ce5187b6e1817883f39d665
-
SHA256
a3bd02befe701e339c84c365fbcde4f046b96a88942b86d38c479fcdd418af39
-
SHA512
3e8fe27fa892ea3f54b18296824d6c31e32353718c048da032a4aa981b536cad08b699f2745904678f33be7168a9e33a6e3d4a14f158e3466622f0cf93b41531
-
SSDEEP
12288:VnX0SCkPsVleAqBf8CBt+N/An1SivnUvZLWjqQ:VXUkkVMZBf8Cmon1SGUhLs
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.72:99
2e737272-72f6-4a08-b1b1-9604212c255c
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-07-06T02:26:21.105296836Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
99
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
2e737272-72f6-4a08-b1b1-9604212c255c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
79.134.225.72
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Processes:
95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe -
Processes:
95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PCI Service = "C:\\Program Files (x86)\\PCI Service\\pcisvc.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exedescription pid process target process PID 3008 set thread context of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\PCI Service\pcisvc.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\PCI Service\pcisvc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exepowershell.exeschtasks.exeRegSvcs.exeschtasks.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 320 schtasks.exe 1408 schtasks.exe 2920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exe95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exeRegSvcs.exepid process 2584 powershell.exe 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe 1928 RegSvcs.exe 1928 RegSvcs.exe 1928 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1928 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2584 powershell.exe Token: SeDebugPrivilege 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe Token: SeDebugPrivilege 1928 RegSvcs.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 3008 wrote to memory of 2584 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe powershell.exe PID 3008 wrote to memory of 2584 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe powershell.exe PID 3008 wrote to memory of 2584 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe powershell.exe PID 3008 wrote to memory of 2584 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe powershell.exe PID 3008 wrote to memory of 320 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe schtasks.exe PID 3008 wrote to memory of 320 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe schtasks.exe PID 3008 wrote to memory of 320 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe schtasks.exe PID 3008 wrote to memory of 320 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe schtasks.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 3008 wrote to memory of 1928 3008 95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe RegSvcs.exe PID 1928 wrote to memory of 1408 1928 RegSvcs.exe schtasks.exe PID 1928 wrote to memory of 1408 1928 RegSvcs.exe schtasks.exe PID 1928 wrote to memory of 1408 1928 RegSvcs.exe schtasks.exe PID 1928 wrote to memory of 1408 1928 RegSvcs.exe schtasks.exe PID 1928 wrote to memory of 2920 1928 RegSvcs.exe schtasks.exe PID 1928 wrote to memory of 2920 1928 RegSvcs.exe schtasks.exe PID 1928 wrote to memory of 2920 1928 RegSvcs.exe schtasks.exe PID 1928 wrote to memory of 2920 1928 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95a92cb1e2eb45772520a4ead4f0c238_JaffaCakes118.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AlAVZExVU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21E2.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:320 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp23C6.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1408 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "PCI Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2415.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2920
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD594397c369298cb7bdff2df82a5518b69
SHA1e32e056cb8f58d21be60414cf2f8931d8fd922fd
SHA256b4fd5f17f286e6033071d5353f17e6483881d1fde60156e1725902f409dfe800
SHA512ccfb429a62d42d931415f053c95e00e6e9218ee7209bb7ba7fa78b2b7e87f3c197b7f05a9025602e3c48be10e8cb371413fead882d09ea184aaaa47cec9626c5
-
Filesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
Filesize
1KB
MD5a4f6fa4537e2dcf0d3e2802c0f070a4d
SHA103545095bfeddd7656b5b8547ab84a810324a94f
SHA256192ac26e1895b267149bde35c55327f4a441693495239da5899062924d45bd11
SHA512a4293123d718b0511a8301a7f536e403cecf8bc89f25f9dc4692b293eb8a554a8eb67993a26fe0e96792b6eb3573b34e9b270777cafe95c2383268da6d40fd2e