Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 09:51
General
-
Target
JaffaCakes118_5bf9ea2e944db4262507116d1c835b84.exe
-
Size
8.8MB
-
MD5
5bf9ea2e944db4262507116d1c835b84
-
SHA1
aa78f2e1ec2a60344869cc5f437054e3f8a83a82
-
SHA256
f515b73dad9aabd93bccfdba33a476a317499aca52649b75f23a3a4d466db54d
-
SHA512
63122cb8477f248dad475ced6981968cfb8baa25013df87331a0e9fcf251877c4d16646995be15f9fba80a7ade75f8cbce448d8922b582a268166f14743905bd
-
SSDEEP
196608:MQmTj3paitEUjeJaebgkMVrIBuOokni/26kSswv1jk/MD9Ey1as9eCRzAZ1c:LmTjZaiBa67VrIB5o+i/H9vp9E8aOeCV
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bf9ea2e944db4262507116d1c835b84.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bf9ea2e944db4262507116d1c835b84.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bf9ea2e944db4262507116d1c835b84.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bf9ea2e944db4262507116d1c835b84.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8482.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp85BB.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\CyberGhost_6.5.0.3180.exe"C:\Users\Admin\AppData\Local\Temp\CyberGhost_6.5.0.3180.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IIPD0.tmp\CyberGhost_6.5.0.3180.tmp"C:\Users\Admin\AppData\Local\Temp\is-IIPD0.tmp\CyberGhost_6.5.0.3180.tmp" /SL5="$401E0,8368008,150528,C:\Users\Admin\AppData\Local\Temp\CyberGhost_6.5.0.3180.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.5MB
MD5c87a81c9ac102701156e3cd7e9a461a5
SHA14771d2646cc491f8e2ffc8189deaaf8adf5f2797
SHA2566a4df2f50a9a2b65284dbd5b991b3426c65c3bd50f7f66748ee52cc91e001769
SHA512f4c4f649dfe81534a9d13d7da96dbb00feaeca3a5fbf8cc06c3e014e4d1002a6af83187a1ce0f4a8fc994ee12fdc6a05ee943adbd268accf63d5e7ac30e1a8f2
-
Filesize
8.8MB
MD55bf9ea2e944db4262507116d1c835b84
SHA1aa78f2e1ec2a60344869cc5f437054e3f8a83a82
SHA256f515b73dad9aabd93bccfdba33a476a317499aca52649b75f23a3a4d466db54d
SHA51263122cb8477f248dad475ced6981968cfb8baa25013df87331a0e9fcf251877c4d16646995be15f9fba80a7ade75f8cbce448d8922b582a268166f14743905bd
-
Filesize
1.2MB
MD5f47a8037d83795f55f88e8deb1e87a1d
SHA1f8f02e6c2824553cbaaa8c0e78040e4c86934b55
SHA256e27b00213de5e63b5f18c7f9b9d1921e1ec0d25893f7a6967354593c8a30dccf
SHA5128c0d025c2ce41541ed262318edd9830293b3c211ca5ffe35ef03e9ed2257feb26598d931ac38f86218e0ab4aaa374077b6683a77741ce688debaa2aa86bcf654
-
Filesize
1KB
MD5a63202db7597a6ef80bbd238df0ef930
SHA1e1f2b9f8fb42f35a2146dbaab72b5d6e6791074d
SHA2564de71c6637f2321f86a3cdefdca49e905e21ac652c476ea432cd1a7cf170ff05
SHA512dca2e70c224582e5f309e0adcaee141f3018938f72c4ce1d90751c60c69aba4ac6f0164771253ae90563496adc94ca9b18c47a01292eb3ecee729d15c2694b85
-
Filesize
1KB
MD5447ab194ab36cb1d20078d80e502b1b2
SHA1a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0
SHA2568d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5
SHA51249ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
68KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB