8c84e36b8fd041628c64743cbbf0a99e57eeb4eeb577be0765d4adf6e6613ff9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 17:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
Size

2.1MB
MD5

02716d38a81377b2ff55202d5e92e6c2
SHA1

6a1e582b794285d86e6a7f85891db524f47927ca
SHA256

8c84e36b8fd041628c64743cbbf0a99e57eeb4eeb577be0765d4adf6e6613ff9
SHA512

b34fcdee73f307c80e5575f0a38b9bce6156621b838a2b37dd71b42836b6815ee290bfa3a1293e8047c034cf065c1f454e3df7999279d88891a8603afef7789a
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023455-6.dat	aspack_v212_v242

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\QuickTime 6.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinRAR 3.11 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinZip 9.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Rainbow Six 3 - Raven Shield No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Freedom - Soldiers of Liberty No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake III No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Paint Shop Pro 9.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\DOOM III No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake 3 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ICUII 5.7 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Delta Force - Black Hawk Down No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Splinter Cell Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Soul Reaver III Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior 3 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Shrek II Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2003 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Civilization III - Conquest No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 3 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 6.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Counter-Strike - Condition Zero Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Paint Shop Pro 8.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\CloneCD 4.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 5 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Half-Life Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FireStarter Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Metal Gear Solid 3 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Microangelo 5.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Railroad Tycoon III No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake III No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Nero Burning ROM 6.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FIFA Soccer 2003 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ICUII 5.x.exe.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Train Simulator II No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Half-Life II No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Railroad Tycoon III No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Train Simulator 2 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior III Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Chrome Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SnagIt 6.2.2 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Black & White 2 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief II No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SWiSH 2.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief III No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Microangelo 6.x Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Praetorians Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\WinZip 8.1 Serial Generator.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Sniper Elite - Berlin 1943 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SimCity IV No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Midtown Madness 3 No-Cd Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\RealOne Player 2.0 Crack.exe	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3480	2340	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe	91
PID 2340 wrote to memory of 3480	2340	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe	91
PID 2340 wrote to memory of 3480	2340	02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02716d38a81377b2ff55202d5e92e6c2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3480

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

232.168.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.168.11.51.in-addr.arpa

IN PTR

Response
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

75.117.19.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.117.19.2.in-addr.arpa

IN PTR

Response

75.117.19.2.in-addr.arpa

IN PTR

a2-19-117-75deploystaticakamaitechnologiescom
DNS

100.209.201.84.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.209.201.84.in-addr.arpa

IN PTR

Response
DNS

0.205.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.205.248.87.in-addr.arpa

IN PTR

Response

0.205.248.87.in-addr.arpa

IN PTR

https-87-248-205-0lgwllnwnet
DNS

5.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

5.173.189.20.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

232.168.11.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

232.168.11.51.in-addr.arpa
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

75.117.19.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

75.117.19.2.in-addr.arpa
8.8.8.8:53

100.209.201.84.in-addr.arpa

dns

73 B
133 B
1
1

DNS Request

100.209.201.84.in-addr.arpa
8.8.8.8:53

0.205.248.87.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

0.205.248.87.in-addr.arpa
8.8.8.8:53

5.173.189.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

5.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
2.1MB

MD5
02716d38a81377b2ff55202d5e92e6c2

SHA1
6a1e582b794285d86e6a7f85891db524f47927ca

SHA256
8c84e36b8fd041628c64743cbbf0a99e57eeb4eeb577be0765d4adf6e6613ff9

SHA512
b34fcdee73f307c80e5575f0a38b9bce6156621b838a2b37dd71b42836b6815ee290bfa3a1293e8047c034cf065c1f454e3df7999279d88891a8603afef7789a

Download Submit
\??\c:\$$$$$.bat

Filesize
228B

MD5
dace718cd218241879ad0d152fd9396a

SHA1
67c5721046d3643c5c068c487e5ab91bb1993248

SHA256
05b4bd35867d10003764371b4d7f0645d9aa98989e24d6317233d22ae974a595

SHA512
3bd90c5f0c093ddfbb9290a4d08ad96babe061fce3938ca6ee18313453bc37856fc00445db8e18349376c0f3eaee513089543b276e499894e281a5af4308d10a

Download Submit
memory/2340-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2340-504-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2340-821-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.