Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 15:59
Static task
static1
Behavioral task
behavioral1
Sample
f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe
-
Size
873KB
-
MD5
f4b7c7fd4a506534cd052fde285714cb
-
SHA1
9d2abc759ce6f9f5eef3082258c9d742ac57b5bc
-
SHA256
0e3d407a6703aa6daac111afc3ef6db70db97cc98bff8b33cc96d97d10a78cdf
-
SHA512
ff127c0c8665a292448053eef48cb33016546dc51875c48c5ba1c618dd82fab9a4d7226260632dacf0d09796fed518a7e3e7c73abdfda75861d4a8991be217e5
-
SSDEEP
24576:/kxpckImocfg6puArbvH+2UU7DnBnpx9eRRkBflmIlTVo:/opBeBOFpjcGBgaT
Malware Config
Extracted
nanocore
1.2.2.0
185.244.30.63:1916
127.0.0.1:1916
bce1779d-9a41-430e-abc2-737cf5900556
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-05-21T21:52:34.187380636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1916
-
default_group
Nano
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
bce1779d-9a41-430e-abc2-737cf5900556
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.244.30.63
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2368 set thread context of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2788 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2616 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 2616 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 2616 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2616 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2616 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2788 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 32 PID 2368 wrote to memory of 2788 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 32 PID 2368 wrote to memory of 2788 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 32 PID 2368 wrote to memory of 2788 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 32 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34 PID 2368 wrote to memory of 2616 2368 f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZvYoLsHRg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp565A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f4b7c7fd4a506534cd052fde285714cb_JaffaCakes118.exe"2⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58b987d3d0542db02ccba9da5de735faf
SHA18dfa4fdc463cc400d058835704d24480ae4f8e09
SHA256c31167a7ee236fbd4d50a711d2ac21ea29aa3f9df01c8eec59e070d94319e7dc
SHA512f824f292842be682699b26b4f58891efda6a3f47f715ba4ae904ae4ce98aba9ffb18e66c4575dc0b38d70594baf18940dfc01270f64f05c7d7a82f5384a5f4fb