bb4a677f60fc4cb80156314d2830df5ee65dae16520dcf17dabc6338399a1c27

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 06:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
Size

128KB
MD5

a5b29dc1915c9126c15108806224b443
SHA1

e1ac365fdf94bd0ae746e2e1c2b708274ca67523
SHA256

bb4a677f60fc4cb80156314d2830df5ee65dae16520dcf17dabc6338399a1c27
SHA512

c0a22ddc964e92444bf5ff6862d6890fc633b2859838af17d24870e1a47e5c7bb9a2d57eb8013f13bfd8cf177b2da9c055e23010a9f23c29659b2ec60cc9ee57
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00090000000174ab-6.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2708	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\Flight Simulator - Century of Flight No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MusicMatch Jukebox 8.0 Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 5.58 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\EverQuest 2 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lord of the Rings - War of the Ring No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.03 Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Delta Force - Black Hawk Down No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Battlefield 1942 - Secret Weapons of World War II Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake III No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Age of Mythology - The Titans No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GeoWhere 2.11 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior III No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinZip 9.x Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior IV No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lords of the Realm III Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Silent Hill III Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\EverQuest 2 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Train Simulator 2 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 5 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lords of the Realm III No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief II Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Counter-Strike - Condition Zero No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NCAA Football 2003 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Splinter Cell Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2002 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Winamp 3.x Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NHL 2003 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Kings of War Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Half-Life 2 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Silent Hill III No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MVP Baseball 2003 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\IconPackager 2.12 Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WindowBlinds 4.x Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Soul Reaver 3 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\World War II - Frontline Command Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake 3 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Winamp 3.x Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashGet 1.x Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 5.x Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Medal of Honor - Allied Assault Breakthrough Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WindowBlinds 4.0 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Max Payne 2 - The Fall of Max Payne Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NBA Live 2004 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Dark Age of Camelot - Trials of Atlantis Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Midtown Madness III Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Serial Generator.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\UT 2004 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Train Simulator II No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 3 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman 2 No-Cd Crack.exe	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2708	3056	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe	31
PID 3056 wrote to memory of 2708	3056	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe	31
PID 3056 wrote to memory of 2708	3056	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe	31
PID 3056 wrote to memory of 2708	3056	a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a5b29dc1915c9126c15108806224b443_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
d1890cf9a673eda997397a428c9a7d9c

SHA1
e3bcec2a3e8cb8eb627b31ffeef65e5351dbddb1

SHA256
7f60abd883d204b8bbab3d00134394fa28ca2dfd3da8e477b22edf3c76ae36f6

SHA512
5c5efd8ca15f6f24951d9361307cbe935ca3464d8eb4657a4142e59c48f9ccb7c4a9c5fb3040ef1c6185d6eec9c79f0d8d52e46bdaa3179107ba9b817d1e1cf5

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
128KB

MD5
a5b29dc1915c9126c15108806224b443

SHA1
e1ac365fdf94bd0ae746e2e1c2b708274ca67523

SHA256
bb4a677f60fc4cb80156314d2830df5ee65dae16520dcf17dabc6338399a1c27

SHA512
c0a22ddc964e92444bf5ff6862d6890fc633b2859838af17d24870e1a47e5c7bb9a2d57eb8013f13bfd8cf177b2da9c055e23010a9f23c29659b2ec60cc9ee57

Download Submit
memory/3056-3-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3056-537-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3056-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads