1d7b403101ba1607a20059db5bef6036873b3447f68a98c7160fffaa83165078

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
Size

2.7MB
MD5

00308f02d4fef1e43a10be7db238139a
SHA1

00a419b8e78d69ab83863d00e4e3d338105b63cb
SHA256

1d7b403101ba1607a20059db5bef6036873b3447f68a98c7160fffaa83165078
SHA512

36b37d6979778f7c752c80dc791753109ac5f3babbd0ce31158ce36305e8ee726718761beab86777337e47c6d1c92b7e9970aac9bfa44d08f831ad71f914b51a
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000156b8-6.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2796	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 9.x Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\CloneCD 4.x Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Train Simulator 2 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2003 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Midtown Madness 3 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman III Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MusicMatch Jukebox 8.x Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SolSuite 2003 Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Half-Life 2 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Sniper Elite - Berlin 1943 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8 Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WindowBlinds 4.0 Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Direct Connect 1.x Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SolSuite 2003 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NASCAR Thunder 2004 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake III Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NCAA Football 2003 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 3 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Silent Hill 3 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Raven Shield Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Winamp 3.x Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Half-Life No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Counter-Strike - Condition Zero No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Neverwinter Nights - Shadows of Undrentide No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Trinity No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Midtown Madness II No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid III Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake IV No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashFXP 1.4 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Medal of Honor - Allied Assault Breakthrough No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Delta Force - Black Hawk Down Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NHL 2002 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Winamp 2.91 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Knights of the Temple No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Soul Reaver 3 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinAce 2.x Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman III No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Half-Life 2 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warcraft III No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\RealOne Player 2.0 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\DOOM 3 No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\UT 2003 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Dark Age of Camelot - Trials of Atlantis No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Rainbow Six 3 - Raven Shield No-Cd Crack.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Ulead GIF Animator 5.x Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 5.0 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\CloneCD 5.0 Serial Generator.exe	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2796	1996	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2796	1996	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2796	1996	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2796	1996	00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00308f02d4fef1e43a10be7db238139a_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
9fb8bb2b144658406ddbf20ba56acf9f

SHA1
6c8f1c9773807e81345e7b7444ee38576081116e

SHA256
4a2806625a5390f24c04d12785fd4aa6766ca2d5c34422fa63f90b8affc7f955

SHA512
7c3024be6345748065eb0a947222c5b84134bb80506a87110e4811c531e4cb8bf922260ee0946867c64116531c223f49776aac411781652f18cec3899d27d46f

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
2.7MB

MD5
00308f02d4fef1e43a10be7db238139a

SHA1
00a419b8e78d69ab83863d00e4e3d338105b63cb

SHA256
1d7b403101ba1607a20059db5bef6036873b3447f68a98c7160fffaa83165078

SHA512
36b37d6979778f7c752c80dc791753109ac5f3babbd0ce31158ce36305e8ee726718761beab86777337e47c6d1c92b7e9970aac9bfa44d08f831ad71f914b51a

Download Submit
memory/1996-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1996-517-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1996-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads