ae6e3c9cf1c29eaecfeb77812a7f157bc87f709efbef44f21d9ecc01e8e4869e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
Size

509KB
MD5

687c0c8c5f4a1da320cb904978dc552f
SHA1

aedbeb1d7ac9ea82b8731db5baf008f5f3eaaf9f
SHA256

ae6e3c9cf1c29eaecfeb77812a7f157bc87f709efbef44f21d9ecc01e8e4869e
SHA512

4dfa06de57ccdcbbb8cc65bbeb17e0474a8173bf58197a058795964beeef242584244d81a452a9ed1f2d2e81244d70ddd31162ae3e622095a0746e7d50d281dd
SSDEEP

3072:7+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:aZmqt6Qyiy3b6CR10TY8JOArF9S9

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2956	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\Paint Shop Pro 8.x Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Dark Age of Camelot - Trials of Atlantis No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Need for Speed Underground Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinAce 2.2 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Adobe Photoshop 7.x Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Soul Reaver 3 No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Warcraft III Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GetRight 6.x Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\PhotoShow 2.0 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinAce 2.x Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warcraft III Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Microangelo 6.x Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Train Simulator 2 No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Winamp 3.x Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.4 Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NHL 2003 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman II No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief III No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\CloneCD 4.x Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\CloneCD 5.0 Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2003 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Star Wars Jedi Knight - Jedi Academy No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman 2 No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\PhotoShow 2.0 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NCAA Football 2003 No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinZip 8.1 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 9.x Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Etherlords II No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior III Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Etherlords II Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lord of the Rings - War of the Ring Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NHL 2002 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.1 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Elder Scrolls III - Tribunal No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\UltraEdit-32 10.x Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2003 No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Max Payne 2 - The Fall of Max Payne No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.03 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warlords IV - Heroes of Etheria Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\The Sims Superstar Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.x Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Kings of War No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior IV No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid III Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lords of EverQuest No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Winamp 2.91 Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Train Simulator II No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\World War II - Frontline Command No-Cd Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\RealOne Player 2.0 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Winamp 3.x Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NBA Live 2003 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Ulead GIF Animator 5.x Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Serial Generator.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.7.143 Crack.exe	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 2956	292	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe	31
PID 292 wrote to memory of 2956	292	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe	31
PID 292 wrote to memory of 2956	292	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe	31
PID 292 wrote to memory of 2956	292	687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\687c0c8c5f4a1da320cb904978dc552f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
ace72152dccdb3e4ce7eb47b13530b55

SHA1
56df5a5eab7c1ca8803fcb836f0293b709620a6a

SHA256
cb8d808cd1ce083a42f1410d5f8dbedd8c31a54af7b3ed2a54815f603aa5ce7f

SHA512
5d6f259071865f14e7958ac96549c0c0c70cd665877053970d25b286e2b53bf27e53dd64c1b8ca9ccfc6b3cadda3486379711a8cfb616205e9934afa24901606

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
509KB

MD5
687c0c8c5f4a1da320cb904978dc552f

SHA1
aedbeb1d7ac9ea82b8731db5baf008f5f3eaaf9f

SHA256
ae6e3c9cf1c29eaecfeb77812a7f157bc87f709efbef44f21d9ecc01e8e4869e

SHA512
4dfa06de57ccdcbbb8cc65bbeb17e0474a8173bf58197a058795964beeef242584244d81a452a9ed1f2d2e81244d70ddd31162ae3e622095a0746e7d50d281dd

Download Submit
memory/292-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/292-704-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/292-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads