123fe2b8fe44c2ea5773338419228036d6413537301d9e7dfc68db9c2896d33f

General

Target

463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
Size

605KB
MD5

463c2d18971229a3763ddb457fd54f02
SHA1

b7cd8db441ec4581146192f6dcbd5417e21ac09c
SHA256

123fe2b8fe44c2ea5773338419228036d6413537301d9e7dfc68db9c2896d33f
SHA512

077a6094c19600e7eb9d1bb5ad69d38b8c2e5ccf5fe3b1f7a532c9b1f138ada6ba51af9259c7b3d1607ed976a78df14babf86c450a5ff9dc08caa3e69371020a
SSDEEP

12288:YpVKboR8rnVKXrxXlxDF3Z4mxxxQwlZrhwIGS7ph38NI:YDA6NzDQmXhltTPhMq

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3992	www.hmhk.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\www.hmhk.cn.exe	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
File opened for modification	C:\Windows\www.hmhk.cn.exe	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
File created	C:\Windows\UNINSTAL.BAT	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4868	3492	WerFault.exe	82
4936	3992	WerFault.exe	89
1608	3492	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
Token: SeDebugPrivilege	3992	www.hmhk.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3992	www.hmhk.cn.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4596	3992	www.hmhk.cn.exe	92
PID 3992 wrote to memory of 4596	3992	www.hmhk.cn.exe	92
PID 3492 wrote to memory of 3452	3492	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	95
PID 3492 wrote to memory of 3452	3492	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	95
PID 3492 wrote to memory of 3452	3492	463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\463c2d18971229a3763ddb457fd54f02_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 404
  2⤵
  - Program crash
  PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 708
  2⤵
  - Program crash
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTAL.BAT
  2⤵
  PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3492 -ip 3492
1⤵
PID:2508

C:\Windows\www.hmhk.cn.exe
C:\Windows\www.hmhk.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 404
  2⤵
  - Program crash
  PID:4936
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3992 -ip 3992
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3492 -ip 3492
1⤵
PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\UNINSTAL.BAT

Filesize
214B

MD5
2518d46ab9e66279d92181f933b2d4f2

SHA1
196968424b9b36d864f1257de34f3eee6f57458d

SHA256
c10ee5924c2f833d00de5bd2554b9b763dc7beb5d853122bf6698bda598521c3

SHA512
15dcaff8a23f0741ffb699873a95eabbc3a7037873f3155589e09b4d4f4d8680dcdd67976e763b9f71c13ea64c1f7d8123767e1383e818bc9291169b45184ac9

Download Submit
C:\Windows\www.hmhk.cn.exe

Filesize
605KB

MD5
463c2d18971229a3763ddb457fd54f02

SHA1
b7cd8db441ec4581146192f6dcbd5417e21ac09c

SHA256
123fe2b8fe44c2ea5773338419228036d6413537301d9e7dfc68db9c2896d33f

SHA512
077a6094c19600e7eb9d1bb5ad69d38b8c2e5ccf5fe3b1f7a532c9b1f138ada6ba51af9259c7b3d1607ed976a78df14babf86c450a5ff9dc08caa3e69371020a

Download Submit
memory/3492-10-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/3492-23-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-28-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-27-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-0-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/3492-25-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-24-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-9-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/3492-22-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-20-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-16-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/3492-15-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/3492-14-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/3492-13-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/3492-12-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/3492-11-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/3492-26-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-17-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-21-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-19-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/3492-8-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3492-7-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3492-5-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3492-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3492-3-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3492-2-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3492-1-0x00000000022C0000-0x0000000002314000-memory.dmp

Filesize
336KB

Download
memory/3492-18-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3492-35-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/3492-36-0x00000000022C0000-0x0000000002314000-memory.dmp

Filesize
336KB

Download
memory/3492-6-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3992-38-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/3992-39-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/3992-43-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing