89ead63e3083f037068d77f445e00aa15f74b3c2a0f8a2a6ffea585b22f29071

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
Size

2.6MB
MD5

054aafc579399d22353e68df44eb090b
SHA1

2c07fb9b3e49ec79535c35c15895f410762640cc
SHA256

89ead63e3083f037068d77f445e00aa15f74b3c2a0f8a2a6ffea585b22f29071
SHA512

fef0b0e25ff8618985479aa740aa002dab9ea7f41d6b691ea8e61b368c7a5c720e3a6cbab21705e508e285737d98dd91a52be05f92a2e765e247422aed27e611
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x001700000001866d-6.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2268	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\NBA Live 2004 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior 3 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\F1 2002 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Ulead GIF Animator 6.x Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Metal Gear Solid Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief 3 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warlords IV - Heroes of Etheria No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\CloneCD 4.x Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\UT 2003 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\DOOM III Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Silent Hill III Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SimCity 4 Rush Hour Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake IV Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.3 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Thief 3 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Midtown Madness 3 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Railroad Tycoon III No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Star Trek - Elite Force II Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Half-Life No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svchosts.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Lords of EverQuest Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake 3 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\mIRC 6.x Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\DOOM 3 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior III No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Medal of Honor - Allied Assault Breakthrough Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\UT 2003 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FIFA Soccer 2003 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashFXP 1.4 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FireStarter No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\EverQuest 2 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ICUII 5.7 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Dark Age of Camelot - Trials of Atlantis No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Shrek 2 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.15 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Paint Shop Pro 8.x Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Soul Reaver 3 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\SnagIt 6.2.2 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Dark Age of Camelot - Trials of Atlantis No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake 4 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\PhotoShow 2.x Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\FlashGet 1.x Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\KaZaA Speedup 3.x Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\ICUII 5.7 Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MechWarrior IV Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Quake 4 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WS_FTP 5.x Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Knights of the Temple Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.7.143 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Armor2net Personal Firewall 3.1 Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Battlefield 1942 - Secret Weapons of World War II Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\Splinter Cell No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\NCAA Football 2003 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Conflict - Desert Storm II - Back to Baghdad No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FireStarter No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 No-Cd Crack.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers32\MVP Baseball 2003 Serial Generator.exe	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2268	2568	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2268	2568	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2268	2568	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2268	2568	054aafc579399d22353e68df44eb090b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\054aafc579399d22353e68df44eb090b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\054aafc579399d22353e68df44eb090b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
228B

MD5
460e6693740b37ea548bbad40144d847

SHA1
f3b07cc596d86a47d19ca1cb6629bda338e52c86

SHA256
45c9c277a0faca86597af02eb965985828308ed287813f347f82ce74d901dbb3

SHA512
1d93d11cdedfea3ca3a1b4108fa2668fc43b107197a5f9c3c287b2f50c24e67c0efb4cc1d7791bccf1ec49624305b3fb2dcff8943c8ce986826426a70cf87530

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
2.6MB

MD5
054aafc579399d22353e68df44eb090b

SHA1
2c07fb9b3e49ec79535c35c15895f410762640cc

SHA256
89ead63e3083f037068d77f445e00aa15f74b3c2a0f8a2a6ffea585b22f29071

SHA512
fef0b0e25ff8618985479aa740aa002dab9ea7f41d6b691ea8e61b368c7a5c720e3a6cbab21705e508e285737d98dd91a52be05f92a2e765e247422aed27e611

Download Submit
memory/2568-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2568-515-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2568-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads