Overview

overview

7

Static

static

3

2560bda69f...18.exe

windows7-x64

7

2560bda69f...18.exe

windows10-2004-x64

7

HFUILib.dll

windows7-x64

3

HFUILib.dll

windows10-2004-x64

3

HuofengGameWorld.exe

windows7-x64

6

HuofengGameWorld.exe

windows10-2004-x64

7

IEAux.dll

windows7-x64

1

IEAux.dll

windows10-2004-x64

1

bin/downlo...Fw.exe

windows7-x64

3

bin/downlo...Fw.exe

windows10-2004-x64

7

bin/downlo...rm.exe

windows7-x64

6

bin/downlo...rm.exe

windows10-2004-x64

6

bin/downlo...FW.exe

windows7-x64

1

bin/downlo...FW.exe

windows10-2004-x64

1

bin/downlo...71.dll

windows7-x64

1

bin/downlo...71.dll

windows10-2004-x64

1

bin/downlo...id.dll

windows7-x64

1

bin/downlo...id.dll

windows10-2004-x64

1

bin/downlo...ne.dll

windows7-x64

1

bin/downlo...ne.dll

windows10-2004-x64

1

bin/downlo...71.dll

windows7-x64

3

bin/downlo...71.dll

windows10-2004-x64

3

bin/downlo...71.dll

windows7-x64

3

bin/downlo...71.dll

windows10-2004-x64

3

bin/downlo...b1.dll

windows7-x64

3

bin/downlo...b1.dll

windows10-2004-x64

3

bin/xldl.dll

windows7-x64

3

bin/xldl.dll

windows10-2004-x64

3

hfgwupdate.exe

windows7-x64

6

hfgwupdate.exe

windows10-2004-x64

6

msvcp100.dll

windows7-x64

3

msvcp100.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    138s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 14:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2560bda69fbb389cf6aa540aa19e987a_JaffaCakes118.exe
  • Size 3.1MB
  • Sample240508-scksxaaa7w
  • SHA256 6916afd799307f0426724542f38f464ed508c2829804dcbb39921f552b3f506c
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bootkitdiscoveryevasionpersistencetrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 22 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2560bda69fbb389cf6aa540aa19e987a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2560bda69fbb389cf6aa540aa19e987a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe
      "C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe" -desktop
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Users\Admin\AppData\Local\HuofengGameWorld\hfgwupdate.exe
        "C:\Users\Admin\AppData\Local\HuofengGameWorld\hfgwupdate.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
    • C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe
      "C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe" -installprotocol
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Enumerates system info in registry
      PID:1992
    • C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe
      "C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe" -install_small_pack 13039594981590899702
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      PID:4684
    • C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe
      "C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe" -installicon 13039594981590899702
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      PID:4632
    • C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe
      "C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe" hfgame://id:13039594981590899702,category:5
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      PID:932

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HFUILib.dll
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\HFUILib.dll
        • Size 312KB
        • SHA256 93125bad493948dd0c577623a364751a1c960561a6b933a2c5dfd8b93421dad5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        HuofengGameWorld.exe
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\HuofengGameWorld.exe
        • Size 955KB
        • SHA256 11456913c0f21eeeb78a85ba0e3f6d7e420d1da47774f53c20973ccb89c04584
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IEAux.dll
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\IEAux.dll
        • Size 64KB
        • SHA256 71141a084a6ccc601f9ae32b5a56476854efde219bdad3c4abc93865fb5e611b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        config.dat
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\config.dat
        • Size 393B
        • SHA256 258bcf86763cceb3e535f1d6422d8b2ba8f99a72af0843027ea54df12e7697db
        • MD5 SHA1 SHA512
        Submit Download

        hfgwupdate.exe
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\hfgwupdate.exe
        • Size 668KB
        • SHA256 44e2c30372e3563f47b0dda78b8db697b8aa2270633437acb927478cb35073e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msvcp100.dll
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\msvcp100.dll
        • Size 411KB
        • SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msvcr100.dll
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\msvcr100.dll
        • Size 755KB
        • SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gamelib.png
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\setting\gamelib.png
        • Size 2KB
        • SHA256 2ca40d953b3df2cb71ad3c649af7da3ef47878d0b647aaf803c4080ca292a797
        • MD5 SHA1 SHA512
        Submit Download

        gamelib_hot.png
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\setting\gamelib_hot.png
        • Size 1KB
        • SHA256 78478d3cb7e8e20e92cea4045b547a931ae0fb36a5a7228d99f4321fa6a1ddb2
        • MD5 SHA1 SHA512
        Submit Download

        mygames.png
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\setting\mygames.png
        • Size 2KB
        • SHA256 f2af69dd00da4e6b1fe8d930824a892cf0e75c9ae3c7a3132ce66288d17efdcb
        • MD5 SHA1 SHA512
        Submit Download

        mygames_hot.png
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\setting\mygames_hot.png
        • Size 1KB
        • SHA256 79abce6749dd99c51dc8c13a9cba57540125df73582176b08d6990758ec09a68
        • MD5 SHA1 SHA512
        Submit Download

        setting.dat
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\setting\setting.dat
        • Size 530B
        • SHA256 13a9660b3115924ee645f8088a344e524d699179f4be201078ea849997d6b9f9
        • MD5 SHA1 SHA512
        Submit Download

        skin.zip
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\skin.zip
        • Size 445KB
        • SHA256 6f02ecbb1aa8ecb8ff2c3d2bc2aca0d19e246c02c884238afd16b027de6f7d96
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\HuofengGameWorld\sqlite3.dll
        • Size 528KB
        • SHA256 38832085b72e6bf16fce077ddc848c0f72e9fb6888a13d0d5cd04ee99ce34d5f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        »ð·ïÓÎÏ·ÊÀ½ç.lnk
        • Path C:\Users\Admin\Desktop\»ð·ïÓÎÏ·ÊÀ½ç.lnk
        • Size 1KB
        • SHA256 1b3fa787b3ed9cfdd5c8a869e0d0ab6b072f7b08a0b03de7792d3ad56aa5244f
        • MD5 SHA1 SHA512
        Submit Download