8c84e36b8fd041628c64743cbbf0a99e57eeb4eeb577be0765d4adf6e6613ff9

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
Size

2.1MB
MD5

02716d38a81377b2ff55202d5e92e6c2
SHA1

6a1e582b794285d86e6a7f85891db524f47927ca
SHA256

8c84e36b8fd041628c64743cbbf0a99e57eeb4eeb577be0765d4adf6e6613ff9
SHA512

b34fcdee73f307c80e5575f0a38b9bce6156621b838a2b37dd71b42836b6815ee290bfa3a1293e8047c034cf065c1f454e3df7999279d88891a8603afef7789a
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0005000000018725-6.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2560	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers32\Half-Life No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Trinity Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SWiSH 2.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Black & White 2 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Midtown Madness 2 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Winamp 2.91 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Civilization III - Conquest Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\World War II - Frontline Command Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Xenus No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NHL 2002 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SolSuite 2003 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WS_FTP 5.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Etherlords II Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 3 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lords of EverQuest No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief 3 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.15 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 6.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\IconPackager 2.12 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Delta Force - Black Hawk Down No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SolSuite 2003 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\IconPackager 2.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 8.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior III Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ICUII 5.x.exe.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief II No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\DOOM III Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SimCity IV Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svchosts.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NBA Live 2003 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 9.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Command & Conquer Generals Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Midtown Madness III Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Hex Workshop Hex Editor 4.1 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.1 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\PhotoShow 2.0 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warlords IV - Heroes of Etheria No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2002 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ICUII 5.7 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake IV Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.4 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WindowBlinds 4.0 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\GetRight 6.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\IconPackager 2.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\GetRight 5.0 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Kings of War Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\EverQuest 2 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2560	1992	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2560	1992	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2560	1992	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2560	1992	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
dace718cd218241879ad0d152fd9396a

SHA1
67c5721046d3643c5c068c487e5ab91bb1993248

SHA256
05b4bd35867d10003764371b4d7f0645d9aa98989e24d6317233d22ae974a595

SHA512
3bd90c5f0c093ddfbb9290a4d08ad96babe061fce3938ca6ee18313453bc37856fc00445db8e18349376c0f3eaee513089543b276e499894e281a5af4308d10a

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
2.1MB

MD5
02716d38a81377b2ff55202d5e92e6c2

SHA1
6a1e582b794285d86e6a7f85891db524f47927ca

SHA256
8c84e36b8fd041628c64743cbbf0a99e57eeb4eeb577be0765d4adf6e6613ff9

SHA512
b34fcdee73f307c80e5575f0a38b9bce6156621b838a2b37dd71b42836b6815ee290bfa3a1293e8047c034cf065c1f454e3df7999279d88891a8603afef7789a

Download Submit
memory/1992-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1992-484-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1992-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads