Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe
-
Size
858KB
-
MD5
945d30684e328c1dc007ed0f71499788
-
SHA1
ac5e19f1e2c964ff70075c66506fee1ac19e79af
-
SHA256
30c3ac8b70c175f99f714f34feb8fae9192260335f2372831fceaed3f4a9e861
-
SHA512
b0835bb184a227dc12653e142140c777c277e18e5f9cfbe40653bc596e8d50e5a251382533aed75cd0c0f451b7aac254442f2e970306275f9cf62eb97337be50
-
SSDEEP
12288:faWzgMg7v3qnCiMErQohh0F4CCJ8lny/QIM1QeauPldhsGepO22Nn:CaHMv6Corjqny/QIMSe1deWn
Malware Config
Extracted
nanocore
1.2.2.0
193.124.180.214:8800
3ce9ef1c-7f3a-4d4f-8ef7-99e9840932ab
-
activate_away_mode
true
-
backup_connection_host
193.124.180.214
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-10-26T15:21:07.509449736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8800
-
default_group
AAA
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3ce9ef1c-7f3a-4d4f-8ef7-99e9840932ab
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
193.124.180.214
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Executes dropped EXE 1 IoCs
pid Process 2780 system.exe -
Loads dropped DLL 2 IoCs
pid Process 2676 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe 2676 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Host = "C:\\Program Files (x86)\\ISS Host\\isshost.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Microsoft Corporation ZdchLQZIJQJCBedD = "C:\\Users\\Admin\\AppData\\Roaming\\ZdchLQZIJQJCBedD.exe" system.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000700000001927a-8.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2780 set thread context of 2164 2780 system.exe 31 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\ISS Host\isshost.exe RegAsm.exe File opened for modification C:\Program Files (x86)\ISS Host\isshost.exe RegAsm.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\ZdchLQZIJQJCBedD.exe:Zone.Identifier:$DATA system.exe File created C:\Users\Admin\AppData\Roaming\system.exe:Zone.Identifier:$DATA 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\system.exe:Zone.Identifier:$DATA system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\system.exe:Zone.Identifier:$DATA system.exe File opened for modification C:\Users\Admin\AppData\Roaming\ZdchLQZIJQJCBedD.exe:Zone.Identifier:$DATA system.exe File created C:\Users\Admin\AppData\Roaming\system.exe:Zone.Identifier:$DATA 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\ZdchLQZIJQJCBedD.exe\:Zone.Identifier:$DATA system.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2564 schtasks.exe 3016 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 RegAsm.exe 2164 RegAsm.exe 2164 RegAsm.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe 2780 system.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2780 system.exe 2164 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2164 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2780 2676 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe 30 PID 2676 wrote to memory of 2780 2676 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe 30 PID 2676 wrote to memory of 2780 2676 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe 30 PID 2676 wrote to memory of 2780 2676 945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe 30 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2780 wrote to memory of 2164 2780 system.exe 31 PID 2164 wrote to memory of 2564 2164 RegAsm.exe 32 PID 2164 wrote to memory of 2564 2164 RegAsm.exe 32 PID 2164 wrote to memory of 2564 2164 RegAsm.exe 32 PID 2164 wrote to memory of 2564 2164 RegAsm.exe 32 PID 2164 wrote to memory of 3016 2164 RegAsm.exe 34 PID 2164 wrote to memory of 3016 2164 RegAsm.exe 34 PID 2164 wrote to memory of 3016 2164 RegAsm.exe 34 PID 2164 wrote to memory of 3016 2164 RegAsm.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\945d30684e328c1dc007ed0f71499788_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Roaming\system.exeC:\Users\Admin\AppData\Roaming\system.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp313E.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2564
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3209.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3016
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
203KB
MD50b6b2bb0cc21924059ee2f4d3b484af1
SHA1e83a8bbed1a28425d56be1f9c3e87965e20d9fa8
SHA256ec4bb6b826974d391dcb82a3992352b110f6f752ebba38b727671261c0ca2912
SHA512401970597faf9d84f12637c7ff5e16e248127b44b1186ab4acc064b77a01fb06082712f13243610a0e32470cbc39069459beee7d48a03e6d332a3559f9bad2cf
-
Filesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
Filesize
1KB
MD53d1580c0395f6de62659467f5b7f1acf
SHA18e73a3885896cecca7ff799a272fc9ddfe06ea96
SHA2566f40196c42a171f24a3e16edeca664cdc5a2f7c150d468255b0e14ab10a2b714
SHA5127637c0d9b03227dffcb00a68d97ddce60bfc40ca0f8a7a4bbd700ea56be6d570908511dea5cab9f609a7da2e558e5298c482fd1e330af085f9c52867d5a847ea
-
Filesize
858KB
MD5945d30684e328c1dc007ed0f71499788
SHA1ac5e19f1e2c964ff70075c66506fee1ac19e79af
SHA25630c3ac8b70c175f99f714f34feb8fae9192260335f2372831fceaed3f4a9e861
SHA512b0835bb184a227dc12653e142140c777c277e18e5f9cfbe40653bc596e8d50e5a251382533aed75cd0c0f451b7aac254442f2e970306275f9cf62eb97337be50