8c4e1f3edfcc474f9cf2175dacb421966fa627cafa5937b3cd73ad9f1095efeb

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
Size

514KB
MD5

f999740e9439e553f81a25b83b346733
SHA1

8a574f8a70bdfa55737847b5c935b42e08c72a71
SHA256

8c4e1f3edfcc474f9cf2175dacb421966fa627cafa5937b3cd73ad9f1095efeb
SHA512

8cf05dd3b66d08e36e25e1d68b3d5ebbf94074b1ea2ded88b766cea3eaffcbed01b330fde4f07fc2a46dafc0eb340979dbf755eadfab00756710c8a38d88b599
SSDEEP

3072:7+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:aZmqt6Qyiy3b6CR10TY8JOArF9S9

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\IL-2 Sturmovik - Forgotten Battles No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 3 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Max Payne 2 - The Fall of Max Payne Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Madden NFL 2003 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NHL 2003 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Ulead GIF Animator 6.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Soul Reaver III Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WindowBlinds 4.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Neverwinter Nights - Shadows of Undrentide Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GeoWhere 2.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinZip 9.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 6.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GetRight 5.0 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashGet 1.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashFXP 1.4 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Kings of War No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Midtown Madness 2 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MVP Baseball 2003 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.7.143 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman 2 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Winamp 2.91 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Elder Scrolls III - Tribunal Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\The Sims Superstar No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Train Simulator II Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GetRight 6.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Train Simulator II No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinZip 8.1 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Chrome Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief 2 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Nero Burning ROM 6.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 5.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lord of the Rings - The Two Towers Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\F1 2002 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Divx 5.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Max Payne 2 - The Fall of Max Payne Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman 2 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MusicMatch Jukebox 8.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinAce 2.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief II No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2003 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\DAP Plus 5.3 Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2003 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WindowBlinds 4.0 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 5.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake III Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 3 No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman III No-Cd Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Nero Burning ROM 6.x Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Crack.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\World War II - Frontline Command Serial Generator.exe	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2844	900	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe	91
PID 900 wrote to memory of 2844	900	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe	91
PID 900 wrote to memory of 2844	900	f999740e9439e553f81a25b83b346733_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\f999740e9439e553f81a25b83b346733_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f999740e9439e553f81a25b83b346733_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
514KB

MD5
f999740e9439e553f81a25b83b346733

SHA1
8a574f8a70bdfa55737847b5c935b42e08c72a71

SHA256
8c4e1f3edfcc474f9cf2175dacb421966fa627cafa5937b3cd73ad9f1095efeb

SHA512
8cf05dd3b66d08e36e25e1d68b3d5ebbf94074b1ea2ded88b766cea3eaffcbed01b330fde4f07fc2a46dafc0eb340979dbf755eadfab00756710c8a38d88b599

Download Submit
\??\c:\$$$$$.bat

Filesize
228B

MD5
be2002d4f4062c3589e1e0a4ea5e8a1b

SHA1
1f86818453417a86c91971127f5a854d638cc582

SHA256
d115d885096ff41d57cf94bd2e5ffa050c36a1990a29915dffc9301547201e58

SHA512
013b97c8f26f823b77bd4b38fa51bed0eaa29c0432e989f875bbb257ac4d5b08b8237b61670216670b567be8bd2fe937c15a2c7a16dbd4e89398e2aadbc92610

Download Submit
memory/900-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/900-527-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/900-821-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads