8c4e1f3edfcc474f9cf2175dacb421966fa627cafa5937b3cd73ad9f1095efeb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
Size

514KB
MD5

f999740e9439e553f81a25b83b346733
SHA1

8a574f8a70bdfa55737847b5c935b42e08c72a71
SHA256

8c4e1f3edfcc474f9cf2175dacb421966fa627cafa5937b3cd73ad9f1095efeb
SHA512

8cf05dd3b66d08e36e25e1d68b3d5ebbf94074b1ea2ded88b766cea3eaffcbed01b330fde4f07fc2a46dafc0eb340979dbf755eadfab00756710c8a38d88b599
SSDEEP

3072:7+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:aZmqt6Qyiy3b6CR10TY8JOArF9S9

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2740	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\Flight Simulator - Century of Flight No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Star Wars Jedi Knight - Jedi Academy Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Midtown Madness II No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.1 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinZip 9.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Midtown Madness 3 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\IL-2 Sturmovik - Forgotten Battles Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Railroad Tycoon III Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\DOOM III Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Soul Reaver III No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief 3 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Warcraft 3 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid III No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Shrek II No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief II No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Command & Conquer Generals Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief III Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2003 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid III Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 6.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 4 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\PhotoShow 2.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Midtown Madness 2 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Adobe Photoshop 8.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SolSuite 2003 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\CloneCD 4.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NASCAR Thunder 2003 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Lords of the Realm III Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MusicMatch Jukebox 8.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Battlefield 1942 - Secret Weapons of World War II Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinZip 8.1 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinZip 8.0 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\mIRC 6.03 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Divx 5.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NHL 2003 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinAce 2.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NBA Live 2004 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GeoWhere 2.11 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief II Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior IV No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\mIRC 6.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.4 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SimCity IV No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Half-Life Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2740	2236	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe	31
PID 2236 wrote to memory of 2740	2236	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe	31
PID 2236 wrote to memory of 2740	2236	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe	31
PID 2236 wrote to memory of 2740	2236	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f999740e9439e553f81a25b83b346733_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
be2002d4f4062c3589e1e0a4ea5e8a1b

SHA1
1f86818453417a86c91971127f5a854d638cc582

SHA256
d115d885096ff41d57cf94bd2e5ffa050c36a1990a29915dffc9301547201e58

SHA512
013b97c8f26f823b77bd4b38fa51bed0eaa29c0432e989f875bbb257ac4d5b08b8237b61670216670b567be8bd2fe937c15a2c7a16dbd4e89398e2aadbc92610

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
514KB

MD5
f999740e9439e553f81a25b83b346733

SHA1
8a574f8a70bdfa55737847b5c935b42e08c72a71

SHA256
8c4e1f3edfcc474f9cf2175dacb421966fa627cafa5937b3cd73ad9f1095efeb

SHA512
8cf05dd3b66d08e36e25e1d68b3d5ebbf94074b1ea2ded88b766cea3eaffcbed01b330fde4f07fc2a46dafc0eb340979dbf755eadfab00756710c8a38d88b599

Download Submit
memory/2236-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2236-534-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2236-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads