Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 16:41
Static task
static1
Behavioral task
behavioral1
Sample
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe
-
Size
641KB
-
MD5
09a8ee07ff8bcdd18f3bc237f6e19c06
-
SHA1
04300a793662035c7ef696e83a9bf6eb30c4e6b9
-
SHA256
3a15d1f531ee5efd3d82e8ebac4ea5fb8277c002f73d3781ec648cf9c65c39ef
-
SHA512
8416d6c77c12fb09390a0b6686e88c81bdd458213f8c7192587e24476efaf9a3a227e42ea1a9d866af767fbb14b80c6c3a66f818caa6b8d45c21fc56a5a91f3b
-
SSDEEP
12288:6OkpGIqQImAu1BEfLDxKlQMZWDT4x+2zXK2xp:GwqIvuBEfYl/ZsT4E2z62
Malware Config
Extracted
nanocore
1.2.2.0
strongodss.ddns.net:58103
79.134.225.43:58103
572eb7a9-aedf-4b39-8669-f7563dab8a38
-
activate_away_mode
false
-
backup_connection_host
79.134.225.43
- backup_dns_server
-
buffer_size
65538
-
build_time
2020-08-31T08:01:57.275180636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
58103
-
default_group
GREAT
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
572eb7a9-aedf-4b39-8669-f7563dab8a38
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
strongodss.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Host = "C:\\Program Files (x86)\\SCSI Host\\scsihost.exe" RegSvcs.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exedescription pid process target process PID 116 set thread context of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\SCSI Host\scsihost.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\SCSI Host\scsihost.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 3252 schtasks.exe 400 schtasks.exe 1528 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exeRegSvcs.exepid process 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe 436 RegSvcs.exe 436 RegSvcs.exe 436 RegSvcs.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 436 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe Token: SeDebugPrivilege 436 RegSvcs.exe Token: SeDebugPrivilege 436 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 116 wrote to memory of 3252 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe schtasks.exe PID 116 wrote to memory of 3252 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe schtasks.exe PID 116 wrote to memory of 3252 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe schtasks.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 116 wrote to memory of 436 116 09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe RegSvcs.exe PID 436 wrote to memory of 400 436 RegSvcs.exe schtasks.exe PID 436 wrote to memory of 400 436 RegSvcs.exe schtasks.exe PID 436 wrote to memory of 400 436 RegSvcs.exe schtasks.exe PID 436 wrote to memory of 1528 436 RegSvcs.exe schtasks.exe PID 436 wrote to memory of 1528 436 RegSvcs.exe schtasks.exe PID 436 wrote to memory of 1528 436 RegSvcs.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\09a8ee07ff8bcdd18f3bc237f6e19c06_JaffaCakes118.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QYQmEmZh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpACCA.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB17D.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB1BD.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpACCA.tmpFilesize
1KB
MD5574391be18ecf3124ae0e954e2db1b4f
SHA16cecf4c5282a601832e149553933092c85638fb1
SHA256514a1a00faf6a6911e4b2b62d1c39d33106831c7a2e83821074ef13f448f7b8b
SHA512a30ee49e327f1f4b0fce34ac499ab36f84f946721e6133d92be06cbdcbb0f7bbf7967ea133d30731929d53cd812c38e8033e47db57b2f8266eb02f90e323111e
-
C:\Users\Admin\AppData\Local\Temp\tmpB17D.tmpFilesize
1KB
MD540b11ef601fb28f9b2e69d36857bf2ec
SHA1b6454020ad2ceed193f4792b77001d0bd741b370
SHA256c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5
-
C:\Users\Admin\AppData\Local\Temp\tmpB1BD.tmpFilesize
1KB
MD59a559f229be0944bc3dc813cde333f50
SHA10e97c97eea032b499ff060e799581e32beeceb09
SHA256a63d853679aa655cced3b62a10855c56f9efd9b50770738b408d728008f73330
SHA5124cbb2f77283500e86ecf79fd2cbd31d10c3af2fcf6c9a557ee0b1edead229dc07d63a5030b60df57458d52ef8c2a42ec199d2d4cdca387400d047df25b593c68
-
memory/116-4-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/116-12-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/116-3-0x0000000075492000-0x0000000075493000-memory.dmpFilesize
4KB
-
memory/116-1-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/116-2-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/116-0-0x0000000075492000-0x0000000075493000-memory.dmpFilesize
4KB
-
memory/436-13-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/436-11-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/436-10-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/436-8-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/436-21-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/436-22-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/436-23-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/436-24-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB
-
memory/436-25-0x0000000075490000-0x0000000075A41000-memory.dmpFilesize
5.7MB