nanocore | 229455d4754a43840bbadb01be0e8018f3170a9634f523db218d281bc2f0c4b6

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe
Size 322KB
Sample240910-kwvs8axbqd
SHA256 229455d4754a43840bbadb01be0e8018f3170a9634f523db218d281bc2f0c4b6
MD5 d7eeaf71c1458f25d67d374f77444478
SHA1 a78043133aa11a7acee8c3d6feaf7479e23433bc
SHA512 0b5be00c906c7b1ff20d293249d079a281261c383edec231b32aaa15961f4853e5cd500e87e3c50a9aacbaaff6684b8a2dd5e7b25ecf98a339dba6d7fc2ff273
SSDEEP 6144:vvfLBiS6ZzVj6FcNDPWIE/K7sIjrNac8pzZGsVKs7fyA:XdiSIzR6+NrWIQFIj1CZGsgs2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
856	TempService.exe
516	TempService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "/Microsoft\\Service.exe"	TempService.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TempService.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 516	856	TempService.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempService.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
516	TempService.exe
516	TempService.exe
516	TempService.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
516	TempService.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	TempService.exe
Token: SeDebugPrivilege	516	TempService.exe
Token: SeDebugPrivilege	516	TempService.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 856	4372	d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe	85
PID 4372 wrote to memory of 856	4372	d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe	85
PID 4372 wrote to memory of 856	4372	d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe	85
PID 856 wrote to memory of 516	856	TempService.exe	86
PID 856 wrote to memory of 516	856	TempService.exe	86
PID 856 wrote to memory of 516	856	TempService.exe	86
PID 856 wrote to memory of 516	856	TempService.exe	86
PID 856 wrote to memory of 516	856	TempService.exe	86
PID 856 wrote to memory of 516	856	TempService.exe	86
PID 856 wrote to memory of 516	856	TempService.exe	86
PID 856 wrote to memory of 516	856	TempService.exe	86

C:\Users\Admin\AppData\Local\Temp\d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d7eeaf71c1458f25d67d374f77444478_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\TempService.exe
  "C:\Users\Admin\AppData\Local\TempService.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Users\Admin\AppData\Local\TempService.exe
    "C:\Users\Admin\AppData\Local\TempService.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TempService.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\TempService.exe.log
Size 492B
SHA256 f21ea43a0528fb812d188ed8380169194090f7bb2833ee399284f9840ead3866
MD5 991385db0b2c89b40dcb099bfd1256be
SHA1 db8f717ee870d7130ab901c5dd695b26fd6fb805
SHA512 7027dc2d8f210d5817ee3df813af2383673cc1404b1bc3e5e46556a25e700265f09453a42a6a52e8e2ca7e0ab60c0f43338a150b0054b6e65c6437efe589595c
MD5 SHA1 SHA512

Submit Download

TempService.exe

Path C:\Users\Admin\AppData\Local\TempService.exe
Size 292KB
SHA256 ae610d62ef8d1cc112d95c8ce8c1c9588cde5b2c981220344d61c7ed79e12e81
MD5 5fa49692c0f0a2b0d134bc48e8411ac1
SHA1 86af606686e4f2232e6d952ba040fc1231b9101a
SHA512 e45d2200d3e3cf37cbc4e30c9e21b49072c9470a6fce9526c7c6fc5d7e7fe9e3a26df5057ad67e079dc66345e08b855a694841b85f460678638568b99827f657
SSDEEP 6144:qBiS6ZzVj6FcNDPWIE/K7sIjrNac8pzZGsVKs7fyA:uiSIzR6+NrWIQFIj1CZGsgs2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/516-35-0x000000006F190000-0x000000006F741000-memory.dmp

Download

memory/516-29-0x000000006F190000-0x000000006F741000-memory.dmp

Download

memory/516-31-0x000000006F190000-0x000000006F741000-memory.dmp

Download

memory/516-28-0x000000006F190000-0x000000006F741000-memory.dmp

Download

memory/856-30-0x000000006F190000-0x000000006F741000-memory.dmp

Download

memory/856-20-0x000000006F192000-0x000000006F193000-memory.dmp

Download

memory/856-22-0x000000006F190000-0x000000006F741000-memory.dmp

Download

memory/856-21-0x000000006F190000-0x000000006F741000-memory.dmp

Download

memory/4372-5-0x0000000005420000-0x000000000542A000-memory.dmp

Download

memory/4372-6-0x00000000056E0000-0x0000000005736000-memory.dmp

Download

memory/4372-8-0x00000000747A0000-0x0000000074F50000-memory.dmp

Download

memory/4372-7-0x00000000747A0000-0x0000000074F50000-memory.dmp

Download

memory/4372-4-0x0000000005450000-0x00000000054E2000-memory.dmp

Download

memory/4372-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Download

memory/4372-3-0x0000000005960000-0x0000000005F04000-memory.dmp

Download

memory/4372-2-0x0000000005310000-0x00000000053AC000-memory.dmp

Download

memory/4372-33-0x00000000747AE000-0x00000000747AF000-memory.dmp

Download

memory/4372-34-0x00000000747A0000-0x0000000074F50000-memory.dmp

Download

memory/4372-1-0x0000000000970000-0x00000000009C6000-memory.dmp

Download