Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 11:45
Static task
static1
Behavioral task
behavioral1
Sample
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe
-
Size
410KB
-
MD5
ae45ec757612c255a5e1a0e42e7f83f1
-
SHA1
0f8bf3bf3160c3ed958c0d628e453ee256de04d1
-
SHA256
abc86a30c916c9a2531c12335b85fd23202cdd8f59f3a273d325f9f585128606
-
SHA512
e7419390bad61d5e99effc26c80632c006d5f8cea5589719dde812020d17603473df132c019ae5efb33709eb13563cc2ae7bcbf1744da790d54d990a68ec70e7
-
SSDEEP
12288:pZTIwkezi3SI92iNo7pW4vFLkBXi8ELdyrheY0S:e3h91e44NL2i8EwNNL
Malware Config
Extracted
nanocore
1.2.2.0
moregrace.duckdns.org:443
cd320ca4-767a-4eb5-b115-620d2b011f74
-
activate_away_mode
true
-
backup_connection_host
moregrace.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-02T00:59:50.651896936Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
443
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
cd320ca4-767a-4eb5-b115-620d2b011f74
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
moregrace.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exedescription pid process target process PID 2844 set thread context of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2572 schtasks.exe 2600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 2672 MSBuild.exe 2672 MSBuild.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 2672 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 2672 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exeMSBuild.exedescription pid process target process PID 2844 wrote to memory of 2572 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe schtasks.exe PID 2844 wrote to memory of 2572 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe schtasks.exe PID 2844 wrote to memory of 2572 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe schtasks.exe PID 2844 wrote to memory of 2572 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe schtasks.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2844 wrote to memory of 2672 2844 ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe MSBuild.exe PID 2672 wrote to memory of 2600 2672 MSBuild.exe schtasks.exe PID 2672 wrote to memory of 2600 2672 MSBuild.exe schtasks.exe PID 2672 wrote to memory of 2600 2672 MSBuild.exe schtasks.exe PID 2672 wrote to memory of 2600 2672 MSBuild.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae45ec757612c255a5e1a0e42e7f83f1_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IcyOBKPuqiF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpADFB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAF43.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpADFB.tmpFilesize
1KB
MD533aea366553dbea6943a6d889cb771f5
SHA1ff425e81951dff821c0078fac02a9f12303ecb50
SHA2561a44615a9ccdff0a15dcb5acb91c602bd7ed7bc4142933ce719165487346d195
SHA512d3c1cb1c589efd2f09262aba8af5673450678bda38c43c717b1268c10fc14ee08c3cc8358a1dd848cff5b1976f4837ba8b3ff4b503f0d1783f60ecdb8293a660
-
C:\Users\Admin\AppData\Local\Temp\tmpAF43.tmpFilesize
1KB
MD5ae766004c0d8792953bafffe8f6a2e3b
SHA114b12f27543a401e2fe0af8052e116cab0032426
SHA2561abdd9b6a6b84e4ba1af1282dc84ce276c59ba253f4c4af05fea498a4fd99540
SHA512e530da4a5d4336fc37838d0e93b5eb3804b9c489c71f6954a47fc81a4c655bb72ec493e109cf96e6e3617d7623ac80697ad3bbd5ffc6281bafc8b34dca5e6567
-
memory/2672-15-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2672-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2672-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2672-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2672-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2672-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2672-11-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2672-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2844-3-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2844-2-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2844-0-0x0000000074761000-0x0000000074762000-memory.dmpFilesize
4KB
-
memory/2844-1-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB
-
memory/2844-24-0x0000000074760000-0x0000000074D0B000-memory.dmpFilesize
5.7MB