92591997526e21c3ad7965da98f44886cf16b7c378453e64b130a0f225d432f1

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
Size

2.0MB
MD5

005eeff56c8539d0080b17d3e24d76ee
SHA1

91b597328ab1491b478e99a6a0229758f712c38d
SHA256

92591997526e21c3ad7965da98f44886cf16b7c378453e64b130a0f225d432f1
SHA512

f34a1eff4842266c154caa61c4fccd46db9b7722eaa5b11acdb4a1cc4c139e9f1fc81620ec26af8514248be74535695d02659a81abecec27ac0aa84116a1bfb8
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a000000015d21-6.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
576	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\mIRC 6.03 Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lord of the Rings - War of the Ring Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Divx 5.x Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Star Wars Jedi Knight - Jedi Academy No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.x Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GetRight 5.x Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Winamp 2.91 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MusicMatch Jukebox 8.x Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8 Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Praetorians No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SimCity 4 No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Train Simulator 2 No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\CloneCD 5.0 Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Chrome Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NBA Live 2004 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\CloneCD 5.0 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FireStarter Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Madden NFL 2003 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 6.x Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Counter-Strike - Condition Zero Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.03 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Raven Shield No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Sniper Elite - Berlin 1943 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid III Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WS_FTP 5.x Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Knights of the Temple No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Shrek 2 No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.x Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Silent Hill 3 No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.4 Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\DOOM III No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Halo Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Train Simulator 2 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\The Sims Superstar Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake 4 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinRAR 3.11 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 5.58 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hex Workshop Hex Editor 4.1 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.7.143 Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Max Payne 2 - The Fall of Max Payne No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 8.x Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief 3 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.7.143 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashFXP 1.4 Serial Generator.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Elder Scrolls III - Tribunal No-Cd Crack.exe	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 576	2200	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe	31
PID 2200 wrote to memory of 576	2200	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe	31
PID 2200 wrote to memory of 576	2200	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe	31
PID 2200 wrote to memory of 576	2200	005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\005eeff56c8539d0080b17d3e24d76ee_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
55d5297e3c331859ffca314b0d990af2

SHA1
febc6b6a728bfe48640744b0eb11b8038f94e146

SHA256
a7899201463346baa2ec3d50d9c659e140f860508b82304453f9e269579c54d7

SHA512
575fe7e28f8dfaab8178cf37bf48b0481cd309471fc9ea8179d9ec8de6c067ec6605e80f6fc0120d3b2f2f134de8d6b9700bbcf05dbb71508a4e8dc3f1f37fa3

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
2.0MB

MD5
005eeff56c8539d0080b17d3e24d76ee

SHA1
91b597328ab1491b478e99a6a0229758f712c38d

SHA256
92591997526e21c3ad7965da98f44886cf16b7c378453e64b130a0f225d432f1

SHA512
f34a1eff4842266c154caa61c4fccd46db9b7722eaa5b11acdb4a1cc4c139e9f1fc81620ec26af8514248be74535695d02659a81abecec27ac0aa84116a1bfb8

Download Submit
memory/2200-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2200-523-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2200-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads