f91c203b4f6fb820406ef4d5c3a5bccd335a30bc27d3ef095e05c33e6dcc510a

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
Size

2.8MB
MD5

019a1f4d235dc8ab255b5e350d3b9316
SHA1

16036d2dc4f833e889a8f1884e8d921c72cf9115
SHA256

f91c203b4f6fb820406ef4d5c3a5bccd335a30bc27d3ef095e05c33e6dcc510a
SHA512

c3f709f641d5957b39ccd46074cfe768af54b8730cc5290ea761efd7199843aed4bd1cf032b42e3ac36745702101870436944f9af8832a2e139630fa1c1daf19
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00020000000178b0-6.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
936	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NASCAR Thunder 2004 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.1 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.4 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NBA Live 2004 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NASCAR Thunder 2004 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\UltraEdit-32 10.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\F1 2002 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\UT 2004 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Midtown Madness III No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Half-Life II Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein Enemy Territory Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SWiSH 2.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Nero Burning ROM 6.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Raven Shield No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Microangelo 6.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman 2 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Soul Reaver 3 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Halo No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ICUII 5.7 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Microangelo 5.x Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Knights of the Temple Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Adobe Photoshop 8.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\RealOne Player 2.0 Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Lord of the Rings - The Two Towers Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Black & White 2 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief 3 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior IV Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Xenus No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\DOOM 3 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman 2 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 5.x Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SolSuite 2003 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 4 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Silent Hill 3 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NBA Live 2003 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Star Trek - Elite Force II No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake IV Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WS_FTP 5.x Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GetRight 5.0 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief 3 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Half-Life 2 No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Knights of the Temple Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\F1 2002 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Silent Hill 3 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Chrome No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 Serial Generator.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Battlefield 1942 - The Road to Rome No-Cd Crack.exe	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 936	2712	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe	30
PID 2712 wrote to memory of 936	2712	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe	30
PID 2712 wrote to memory of 936	2712	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe	30
PID 2712 wrote to memory of 936	2712	019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\019a1f4d235dc8ab255b5e350d3b9316_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
f9f93d57e9e9ec4107200ff894977a4c

SHA1
fd2dcb5e71c5e144160b98747e0979dbcc5eb47c

SHA256
6634105b55e6bd325cea6b91f4a02256b9525141033a24aea20f4b2d0887e79f

SHA512
276f62bc5f98e36e741b83ad1ce32fff319b26f0b7627e2eaea216c5c4eb3373b6adcf71e635e22855b6135d0dd41bca4d4bdf900e40e0ff0fa9ef3f2ef07daa

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
2.8MB

MD5
019a1f4d235dc8ab255b5e350d3b9316

SHA1
16036d2dc4f833e889a8f1884e8d921c72cf9115

SHA256
f91c203b4f6fb820406ef4d5c3a5bccd335a30bc27d3ef095e05c33e6dcc510a

SHA512
c3f709f641d5957b39ccd46074cfe768af54b8730cc5290ea761efd7199843aed4bd1cf032b42e3ac36745702101870436944f9af8832a2e139630fa1c1daf19

Download Submit
memory/2712-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2712-366-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2712-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads