123fe2b8fe44c2ea5773338419228036d6413537301d9e7dfc68db9c2896d33f

General

Target

463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
Size

605KB
MD5

463c2d18971229a3763ddb457fd54f02
SHA1

b7cd8db441ec4581146192f6dcbd5417e21ac09c
SHA256

123fe2b8fe44c2ea5773338419228036d6413537301d9e7dfc68db9c2896d33f
SHA512

077a6094c19600e7eb9d1bb5ad69d38b8c2e5ccf5fe3b1f7a532c9b1f138ada6ba51af9259c7b3d1607ed976a78df14babf86c450a5ff9dc08caa3e69371020a
SSDEEP

12288:YpVKboR8rnVKXrxXlxDF3Z4mxxxQwlZrhwIGS7ph38NI:YDA6NzDQmXhltTPhMq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2556	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	www.hmhk.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\www.hmhk.cn.exe	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
File opened for modification	C:\Windows\www.hmhk.cn.exe	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
File created	C:\Windows\UNINSTAL.BAT	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
Token: SeDebugPrivilege	2788	www.hmhk.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	www.hmhk.cn.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2756	2788	www.hmhk.cn.exe	31
PID 2788 wrote to memory of 2756	2788	www.hmhk.cn.exe	31
PID 2788 wrote to memory of 2756	2788	www.hmhk.cn.exe	31
PID 2788 wrote to memory of 2756	2788	www.hmhk.cn.exe	31
PID 2976 wrote to memory of 2556	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	32
PID 2976 wrote to memory of 2556	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	32
PID 2976 wrote to memory of 2556	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	32
PID 2976 wrote to memory of 2556	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	32
PID 2976 wrote to memory of 2556	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	32
PID 2976 wrote to memory of 2556	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	32
PID 2976 wrote to memory of 2556	2976	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\UNINSTAL.BAT
  2⤵
  - Deletes itself
  PID:2556

C:\Windows\www.hmhk.cn.exe
C:\Windows\www.hmhk.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\UNINSTAL.BAT

Filesize
214B

MD5
2518d46ab9e66279d92181f933b2d4f2

SHA1
196968424b9b36d864f1257de34f3eee6f57458d

SHA256
c10ee5924c2f833d00de5bd2554b9b763dc7beb5d853122bf6698bda598521c3

SHA512
15dcaff8a23f0741ffb699873a95eabbc3a7037873f3155589e09b4d4f4d8680dcdd67976e763b9f71c13ea64c1f7d8123767e1383e818bc9291169b45184ac9

Download Submit
C:\Windows\www.hmhk.cn.exe

Filesize
605KB

MD5
463c2d18971229a3763ddb457fd54f02

SHA1
b7cd8db441ec4581146192f6dcbd5417e21ac09c

SHA256
123fe2b8fe44c2ea5773338419228036d6413537301d9e7dfc68db9c2896d33f

SHA512
077a6094c19600e7eb9d1bb5ad69d38b8c2e5ccf5fe3b1f7a532c9b1f138ada6ba51af9259c7b3d1607ed976a78df14babf86c450a5ff9dc08caa3e69371020a

Download Submit
memory/2788-32-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2788-28-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2788-27-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2788-15-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2976-3-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2976-8-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/2976-5-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2976-4-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/2976-0-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2976-2-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/2976-7-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/2976-6-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2976-9-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2976-24-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2976-25-0x0000000000310000-0x0000000000364000-memory.dmp

Filesize
336KB

Download
memory/2976-10-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2976-11-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/2976-1-0x0000000000310000-0x0000000000364000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing