362170e04bd4e9093f37eabd6ce56c118f7692ce66c0d9c07e8fd19570f56cdc

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 01:30 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe
Size

204KB
MD5

2a820d6c1f534eaaeb806493418616c1
SHA1

144c5b1ef5dbf5cd88c83b580924deb872c8407e
SHA256

362170e04bd4e9093f37eabd6ce56c118f7692ce66c0d9c07e8fd19570f56cdc
SHA512

df28a9eccb64b847328038b4ba9ab723fed6bf928e661ce5e0595d58ebaf92518f05a667c4f581c1c40fde3ff9c680e40f03c3c02ae018f6bf06f7e97ab5b7c7
SSDEEP

1536:xXz230zZ3NMsOfXu7Ke9TG4yMSmcUk6lCbQvmSTpJwuqCNQR6nkX5SADkPY+Gdt1:Ry30ZTTG4yMZc9pJSTp63ZXB

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jiuiqi.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1108	jiuiqi.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /l"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /i"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /k"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /X"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /v"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /Z"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /o"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /G"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /T"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /y"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /J"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /z"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /H"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /j"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /g"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /M"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /C"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /Y"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /Q"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /F"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /q"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /W"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /O"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /A"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /P"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /r"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /a"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /U"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /D"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /x"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /d"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /S"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /m"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /w"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /p"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /c"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /s"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /I"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /N"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /K"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /b"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /f"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /t"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /u"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /L"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /E"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /h"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /R"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /e"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /n"	jiuiqi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuiqi = "C:\\Users\\Admin\\jiuiqi.exe /V"	jiuiqi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe
1108	jiuiqi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2332	2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe
1108	jiuiqi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1108	2332	2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe	85
PID 2332 wrote to memory of 1108	2332	2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe	85
PID 2332 wrote to memory of 1108	2332	2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe	85
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81
PID 1108 wrote to memory of 2332	1108	jiuiqi.exe	81

C:\Users\Admin\AppData\Local\Temp\2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\jiuiqi.exe
  "C:\Users\Admin\jiuiqi.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1108

Network

DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.dual-a-0034.a-msedge.net

g-bing-com.dual-a-0034.a-msedge.net

IN CNAME

dual-a-0034.a-msedge.net

dual-a-0034.a-msedge.net

IN A

13.107.21.237

dual-a-0034.a-msedge.net

IN A

204.79.197.237
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

Remote address:

13.107.21.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0320E235293E6A962E1EF68328DE6B2E; domain=.bing.com; expires=Sat, 02-Aug-2025 06:11:14 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B509BFD2F6494F88ADCF8D53E7FCE899 Ref B: LON04EDGE1210 Ref C: 2024-07-08T06:11:14Z
date: Mon, 08 Jul 2024 06:11:13 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

Remote address:

13.107.21.237:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0320E235293E6A962E1EF68328DE6B2E

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=cfg-8SiOB-JPkBTyQasANq7x2pynGr66fyqKD1NrboM; domain=.bing.com; expires=Sat, 02-Aug-2025 06:11:14 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AEF0B603E2CA44CD85E497934C5BD2C9 Ref B: LON04EDGE1210 Ref C: 2024-07-08T06:11:14Z
date: Mon, 08 Jul 2024 06:11:14 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

Remote address:

13.107.21.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0320E235293E6A962E1EF68328DE6B2E; MSPTC=cfg-8SiOB-JPkBTyQasANq7x2pynGr66fyqKD1NrboM

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 54558A9A737B46E0BB3DD9DA7EB77792 Ref B: LON04EDGE1210 Ref C: 2024-07-08T06:11:14Z
date: Mon, 08 Jul 2024 06:11:14 GMT
DNS

101.58.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.58.20.217.in-addr.arpa

IN PTR

Response
DNS

4.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.159.190.20.in-addr.arpa

IN PTR

Response
DNS

237.21.107.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

237.21.107.13.in-addr.arpa

IN PTR

Response
DNS

ns1.player1253.com

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

ns1.player1253.com

IN A

Response
DNS

ns1.videoall.net

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

ns1.videoall.net

IN A

Response
DNS

ns1.videoall.net

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

ns1.videoall.net

IN A
DNS

ns1.mediashares.org

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

ns1.mediashares.org

IN A

Response

ns1.mediashares.org

IN A

107.178.223.183

ns1.mediashares.org

IN A

104.155.138.21
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR
DNS

44.56.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

44.56.20.217.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

11.179.89.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.179.89.13.in-addr.arpa

IN PTR

Response

13.107.21.237:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

tls, http2

2.0kB
9.2kB
21
16

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4668098b9197447c80023f821095ca96&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

HTTP Response

204

8.8.8.8:53

g.bing.com

dns

56 B
151 B
1
1

DNS Request

g.bing.com

DNS Response

13.107.21.237

204.79.197.237
8.8.8.8:53

101.58.20.217.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

101.58.20.217.in-addr.arpa
8.8.8.8:53

4.159.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

4.159.190.20.in-addr.arpa
8.8.8.8:53

237.21.107.13.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

237.21.107.13.in-addr.arpa
8.8.8.8:53

ns1.player1253.com

dns

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

64 B
137 B
1
1

DNS Request

ns1.player1253.com
8.8.8.8:53

ns1.videoall.net

dns

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

124 B
135 B
2
1

DNS Request

ns1.videoall.net

DNS Request

ns1.videoall.net
8.8.8.8:53

ns1.mediashares.org

dns

2a820d6c1f534eaaeb806493418616c1_JaffaCakes118.exe

65 B
97 B
1
1

DNS Request

ns1.mediashares.org

DNS Response

107.178.223.183

104.155.138.21
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

219 B
147 B
3
1

DNS Request

103.169.127.40.in-addr.arpa

DNS Request

103.169.127.40.in-addr.arpa

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

148 B
128 B
2
1

DNS Request

172.214.232.199.in-addr.arpa

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

44.56.20.217.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

44.56.20.217.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

11.179.89.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

11.179.89.13.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\jiuiqi.exe

Filesize
204KB

MD5
00862d9b1001a9f036b4546c75160ce9

SHA1
0015bd1fd7c382f77ede2179c4a98dbe4fd98116

SHA256
0bc8967da7e873be233ababdf046023dfe8fc7a49a4f8d094cf31ad29831c826

SHA512
89beb0f1d5523ce87ab49ffad5de7b841aa43a99e1d403ae0bdf51eb899541482aa6994b39b129785d8c18e19f699fba3df84426a7c628a1e7cdc8438483ce20

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.