nanocore | b1d04d78ca542907bf8e87ac423cce20039b745b9500d292dcc1764feb660931

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
Size

804KB
MD5

96c46f1028dfd68dcafc774a331b7887
SHA1

a3f23dec1b19baeb71e75a9891a7a13a021c93bd
SHA256

b1d04d78ca542907bf8e87ac423cce20039b745b9500d292dcc1764feb660931
SHA512

ab318cb3228f0dd9087c64d4ea0e5021ec372a44c65d55a4d4209fba3b83e3b31cccb5f85c250fc31b650118a3e9891fa8dff45d142e41c576607739f51b3470
SSDEEP

12288:JGpk59Z3PCPoflr7RTd1To2k6qYa84nCsVcN9L4+xEWLIqD1fvIlwvCeP0/5KWRT:zdVPqY/4EIqD1Ylwvtz5C

Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Executes dropped EXE 2 IoCs

pid	Process
2612	audiotunes.exe
972	audiotunes.exe

Loads dropped DLL 2 IoCs

pid	Process
2776	cmd.exe
2612	audiotunes.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiotunes.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	audiotunes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	audiotunes.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 972	2612	audiotunes.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiotunes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiotunes.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
2612	audiotunes.exe
2612	audiotunes.exe
2612	audiotunes.exe
2612	audiotunes.exe
972	audiotunes.exe
972	audiotunes.exe
972	audiotunes.exe
972	audiotunes.exe
972	audiotunes.exe
972	audiotunes.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
972	audiotunes.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2612	audiotunes.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
Token: SeDebugPrivilege	2612	audiotunes.exe
Token: SeDebugPrivilege	972	audiotunes.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2884	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2884	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2884	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2884	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2636	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	34
PID 2268 wrote to memory of 2636	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	34
PID 2268 wrote to memory of 2636	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	34
PID 2268 wrote to memory of 2636	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	34
PID 2268 wrote to memory of 2776	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	36
PID 2268 wrote to memory of 2776	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	36
PID 2268 wrote to memory of 2776	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	36
PID 2268 wrote to memory of 2776	2268	96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe	36
PID 2776 wrote to memory of 2612	2776	cmd.exe	38
PID 2776 wrote to memory of 2612	2776	cmd.exe	38
PID 2776 wrote to memory of 2612	2776	cmd.exe	38
PID 2776 wrote to memory of 2612	2776	cmd.exe	38
PID 2776 wrote to memory of 2612	2776	cmd.exe	38
PID 2776 wrote to memory of 2612	2776	cmd.exe	38
PID 2776 wrote to memory of 2612	2776	cmd.exe	38
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39
PID 2612 wrote to memory of 972	2612	audiotunes.exe	39

C:\Users\Admin\AppData\Local\Temp\96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96c46f1028dfd68dcafc774a331b7887_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\37a9f99f-41f8-4c98-ad5a-89e2379234cf" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2884
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\37a9f99f-41f8-4c98-ad5a-89e2379234cf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1735553437.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K "C:\ProgramData\audiotunes.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\ProgramData\audiotunes.exe
    C:\ProgramData\audiotunes.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Maps connected drives based on registry
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\ProgramData\audiotunes.exe
      C:\ProgramData\audiotunes.exe
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\audiotunes.exe

Filesize
804KB

MD5
216777696771deaeacae743b218f1580

SHA1
c281deaa722722a2e745252d5496bed9f2d6585b

SHA256
b505e3508317160fd2193b39f0f0cfb386226d6b2ed7a67c3b39649d66eef930

SHA512
cf84ccdc576f02011c0aab6e69505a34e3e5b9d539017748e973853f98d48f20c8047bacb48d1e3f0df1f92f0584648260e82be049ea132116fbc3d7b83c47cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1735553437.tmp

Filesize
1KB

MD5
c780930328bd4d15aa166d05c95b7a1b

SHA1
fdd84e8f43c616b897dbea2489de55065638d01e

SHA256
b6f6e685d7cfd5c106b9ec0713773717a47253bb0faad75c548e2ea5bf29abb2

SHA512
8358f8c17d66f3bae49fa1d605ee96216481792a6fdc320fa58d9f62c8075c2d8d1034b628024941b7f4479c92fe60db6c1b4ba321dea3b7e641b6a6a605166f

Download Submit
memory/972-25-0x0000000000090000-0x00000000000EC000-memory.dmp

Filesize
368KB

Download
memory/972-26-0x0000000000090000-0x00000000000EC000-memory.dmp

Filesize
368KB

Download
memory/972-22-0x0000000000090000-0x00000000000EC000-memory.dmp

Filesize
368KB

Download
memory/2268-8-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-6-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-7-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-0-0x00000000741C1000-0x00000000741C2000-memory.dmp

Filesize
4KB

Download
memory/2268-5-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-15-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-4-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-3-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-2-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2268-1-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2612-19-0x00000000004B0000-0x00000000005B0000-memory.dmp

Filesize
1024KB

Download
memory/2612-20-0x0000000006200000-0x0000000006203000-memory.dmp

Filesize
12KB

Download