30bb66ae02051688ae19ecfe1af297ce2db2baaa5c8c86a29bc6c22d311c23a1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
Size

421KB
MD5

3616e7d274d63723769cd027c2cccba6
SHA1

91ced2e1a45a310c814c9ee95bdc9936228ac8f4
SHA256

30bb66ae02051688ae19ecfe1af297ce2db2baaa5c8c86a29bc6c22d311c23a1
SHA512

e50b677cbdb8056e830e6d55b28606ed82f772c154c96af802677b7d0f74c8b689be7f545d3857f3516f45ca75d066cb22705042ead036eddb319930ff7ae735
SSDEEP

3072:7+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:aZmqt6Qyiy3b6CR10TY8JOArF9S9

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2748	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\PhotoShow 2.x Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Praetorians No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\IconPackager 2.x Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NBA Live 2004 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\CloneCD 4.x Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein Enemy Territory Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WS_FTP 5.x Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Etherlords II Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Madden NFL 2004 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\EverQuest 2 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MusicMatch Jukebox 8.x Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lord of the Rings - The Two Towers No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Silent Hill 3 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Need for Speed Underground Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Midtown Madness 3 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Need for Speed Underground Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Halo Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Shrek II No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 5.58 Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Splinter Cell Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Raven Shield Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2003 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\PhotoShow 2.0 Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinZip 8.0 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake 3 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NHL 2002 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\UT 2003 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\IL-2 Sturmovik - Forgotten Battles Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8x Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\QuickTime 6.x Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NCAA Football 2004 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\DOOM 3 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Shrek II Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief 3 No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Half-Life No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2003 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Shrek II No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Trinity Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SnagIt 6.2.2 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\QuickTime 6.x Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 6.x Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\World War II - Frontline Command No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Delta Force - Black Hawk Down No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\RealOne Player 2.0 Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake IV Serial Generator.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid No-Cd Crack.exe	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2748	2652	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2748	2652	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2748	2652	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2748	2652	3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3616e7d274d63723769cd027c2cccba6_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
24f85ddd1a0c3ec7777850c453656edf

SHA1
88188e70e58825f403d9f6d3a609f97303607fdb

SHA256
c7f452dc4381a7e0fd74813a81b7e6d20d721098e90f2b369e9f249b3d3d98a7

SHA512
dc707bf537ba318382db8e185ac304290cc81e821073022df91056696d9a03a201a43b8318955c9f498642ed3f80bfbba5ecc7e5c1e99ba339c4e2a76da60734

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
421KB

MD5
3616e7d274d63723769cd027c2cccba6

SHA1
91ced2e1a45a310c814c9ee95bdc9936228ac8f4

SHA256
30bb66ae02051688ae19ecfe1af297ce2db2baaa5c8c86a29bc6c22d311c23a1

SHA512
e50b677cbdb8056e830e6d55b28606ed82f772c154c96af802677b7d0f74c8b689be7f545d3857f3516f45ca75d066cb22705042ead036eddb319930ff7ae735

Download Submit
memory/2652-3-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2652-703-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2652-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads