Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 09:03
Behavioral task
behavioral1
Sample
eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
eac33a8ca4b4f6d5f62ad4213cdc8079
-
SHA1
05a036b00742b23305192f1c3f2044c27c971abc
-
SHA256
4b47ecff546748d8c35339a6608780733736e26ac76deb68971c83841b28710c
-
SHA512
0aac29c17ea04f320de30f938f07c563c66cc6d0cde516707215b60ae389c2467fb6d626980115ff5de8044d497790ca8cb2b13cd072036bb97c8f217ef40f76
-
SSDEEP
49152:Q2GV7D5sm5sy+Ol498fjbK0Amc4JHiMIWH5ddm6d2R16qMNVNLL6:Q2M7D5sm55+OS98fiz4HhH5dI6AcrNLG
Malware Config
Extracted
nanocore
1.2.2.0
194.5.97.48:4488
0ccdecad-0899-45d4-aa28-34c7e592b23b
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-02-22T00:54:08.580070336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4488
-
default_group
PRODUCTS
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
0ccdecad-0899-45d4-aa28-34c7e592b23b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
194.5.97.48
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Operaa.vbs notepad.exe -
Executes dropped EXE 3 IoCs
pid Process 3920 test.exe 2212 test.exe 5092 test.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Monitor = "C:\\Program Files (x86)\\SCSI Monitor\\scsimon.exe" test.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA test.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3920 set thread context of 2212 3920 test.exe 94 -
resource yara_rule behavioral2/memory/1624-0-0x0000000000400000-0x00000000008B3000-memory.dmp upx behavioral2/files/0x0009000000023cb5-4.dat upx behavioral2/memory/3920-5-0x0000000000400000-0x00000000004FE000-memory.dmp upx behavioral2/memory/3920-9-0x0000000000400000-0x00000000004FE000-memory.dmp upx behavioral2/memory/3920-7-0x0000000000400000-0x00000000004FE000-memory.dmp upx behavioral2/memory/1624-10-0x0000000000400000-0x00000000008B3000-memory.dmp upx behavioral2/memory/2212-11-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/2212-16-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/5092-24-0x0000000000400000-0x00000000004FE000-memory.dmp upx behavioral2/memory/2212-21-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/5092-27-0x0000000000400000-0x00000000004FE000-memory.dmp upx behavioral2/memory/1624-41-0x0000000000400000-0x00000000008B3000-memory.dmp upx behavioral2/memory/2212-18-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/2212-14-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/5092-50-0x0000000000400000-0x00000000004FE000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\SCSI Monitor\scsimon.exe test.exe File opened for modification C:\Program Files (x86)\SCSI Monitor\scsimon.exe test.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4052 schtasks.exe 848 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3920 test.exe 3920 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 2212 test.exe 2212 test.exe 2212 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe 5092 test.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2212 test.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3920 test.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2212 test.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1624 wrote to memory of 4204 1624 eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe 84 PID 1624 wrote to memory of 4204 1624 eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe 84 PID 1624 wrote to memory of 4204 1624 eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe 84 PID 4204 wrote to memory of 3920 4204 cmd.exe 85 PID 4204 wrote to memory of 3920 4204 cmd.exe 85 PID 4204 wrote to memory of 3920 4204 cmd.exe 85 PID 3920 wrote to memory of 4840 3920 test.exe 93 PID 3920 wrote to memory of 4840 3920 test.exe 93 PID 3920 wrote to memory of 4840 3920 test.exe 93 PID 3920 wrote to memory of 4840 3920 test.exe 93 PID 3920 wrote to memory of 4840 3920 test.exe 93 PID 3920 wrote to memory of 2212 3920 test.exe 94 PID 3920 wrote to memory of 2212 3920 test.exe 94 PID 3920 wrote to memory of 2212 3920 test.exe 94 PID 3920 wrote to memory of 5092 3920 test.exe 95 PID 3920 wrote to memory of 5092 3920 test.exe 95 PID 3920 wrote to memory of 5092 3920 test.exe 95 PID 2212 wrote to memory of 4052 2212 test.exe 96 PID 2212 wrote to memory of 4052 2212 test.exe 96 PID 2212 wrote to memory of 4052 2212 test.exe 96 PID 2212 wrote to memory of 848 2212 test.exe 98 PID 2212 wrote to memory of 848 2212 test.exe 98 PID 2212 wrote to memory of 848 2212 test.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4840
-
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE82D.tmp"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4052
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE87C.tmp"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:848
-
-
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe" 2 2212 2406414684⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5092
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
556KB
MD54f8c873b5d7a91daf870117f1fa7899c
SHA1fd3157965bd41c96134aa384d3d2a473cd34a928
SHA25604ca7678a00fe66ce4eeffdbcf8a48974468a874287f013af736541851403eef
SHA5125bde62b364000257904d9bd2200557df573a78fdd6ff8b26b5ea9a63b6aa43d43a38fe6469fdef849706ebdfdcb0f45518f44ced64cce9c4c87539e85e48d25b
-
Filesize
1KB
MD5daa959fa3888b5436fb93b6796bc803b
SHA143b8b749c623daede8374165806b8354655fa06c
SHA256da87a4088b0f1dce79ca8128c8275cb6eaf527e571c68a6fb3a0b56576d38344
SHA512aba76a0d311ad0466c64aac0d8f6ed483d2006dc0f14ac78af6af33b9db920a3735fa9478bb6fc5535f4b5eb9621479ec6f8172e05089c27872016ae08f896f0
-
Filesize
1KB
MD52862e61d09852ea2886c036af0465051
SHA145e30b14543868213f7f1cba0a1e0cc840fb2cd2
SHA256d4ba6219d0aff5a36d129a8475cf35b00043d205f751f63ddd56a5c7d4a03ff3
SHA51233dfd9d12adaa19dd3d4dd7013930e233dd3ff1d114e1e86e50d20ffa848a27582eebdffc09ab974b8de86316c01da6f6254f349992ad507d0f8b13cf0e36579