nanocore | 40aae024ca198bbac5bd47b1d852cd742287baec8fd674af2607365ad8394e7b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
Size

202KB
MD5

aa5a513f1fdc0a8817e6f3af2f6c25c6
SHA1

c203df1e9fe8ce9cf051d9765bfc4c52770fea21
SHA256

40aae024ca198bbac5bd47b1d852cd742287baec8fd674af2607365ad8394e7b
SHA512

98543f453cb361a860345b25e9fdb45b9c402b889bdb176c21a92468c5d7230c8573d82013a201021c3406f716ee779627b12ce6eecd62e233401cc16c50418a
SSDEEP

6144:gLV6Bta6dtJmakIM5Ss0ytgxpA+wyAR+U8gbP:gLV6BtpmkBv/pA+XM+XQ

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

pid process

4856 aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
4856 aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
4856 aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

pid process

4856 aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4856 aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

pid	process
4856	aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
4856	aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
4856	aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

pid	process
4856	aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4856	aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa5a513f1fdc0a8817e6f3af2f6c25c6_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4856-0-0x0000000074B02000-0x0000000074B03000-memory.dmp

Filesize
4KB

Download
memory/4856-1-0x0000000074B00000-0x00000000750B1000-memory.dmp

Filesize
5.7MB

Download
memory/4856-2-0x0000000074B00000-0x00000000750B1000-memory.dmp

Filesize
5.7MB

Download
memory/4856-4-0x0000000074B00000-0x00000000750B1000-memory.dmp

Filesize
5.7MB

Download
memory/4856-5-0x0000000074B02000-0x0000000074B03000-memory.dmp

Filesize
4KB

Download
memory/4856-6-0x0000000074B00000-0x00000000750B1000-memory.dmp

Filesize
5.7MB

Download
memory/4856-7-0x0000000074B00000-0x00000000750B1000-memory.dmp

Filesize
5.7MB

Download