cdbadc9abd00d0651339f0079dd86530a8ae5e7c86df8c1fec752a5e1a8ced60

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe
Size

743KB
MD5

15f1a4f226616e25120cc0f5cf660f4d
SHA1

344b57cff93712c5003fb97f0fe6fb28e4f494c3
SHA256

cdbadc9abd00d0651339f0079dd86530a8ae5e7c86df8c1fec752a5e1a8ced60
SHA512

ac364746262ecb658368948d0036aad20ec5c22e4c53329d5fb3fc8ede42f542a2ddaf022fe3839d7c3c6effbe07159f0a4d70e8122fd167e53dc91d139a35d0
SSDEEP

12288:wX/eOyaiqK+XTQcJtEWySf0KY5nwX/eOyaiq/8Xu:wX/eO4qdDQcLEq8znwX/eO4q0Xu

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\hdgw.exe -dwup"	hdgw.exe

Executes dropped EXE 49 IoCs

pid	Process
2688	hdgw.exe
2692	hdgw.exe
2528	hdgw.exe
2876	hdgw.exe
2892	hdgw.exe
1548	hdgw.exe
1552	hdgw.exe
1768	hdgw.exe
2128	hdgw.exe
484	hdgw.exe
2092	hdgw.exe
2228	hdgw.exe
2380	hdgw.exe
2108	hdgw.exe
2372	hdgw.exe
1776	hdgw.exe
1260	hdgw.exe
1684	hdgw.exe
1276	hdgw.exe
604	hdgw.exe
1240	hdgw.exe
2296	hdgw.exe
700	hdgw.exe
2272	hdgw.exe
2056	hdgw.exe
2740	hdgw.exe
2676	hdgw.exe
2220	hdgw.exe
2932	hdgw.exe
1664	hdgw.exe
3012	hdgw.exe
3020	hdgw.exe
1880	hdgw.exe
1288	hdgw.exe
1760	hdgw.exe
1616	hdgw.exe
2280	hdgw.exe
2780	hdgw.exe
320	hdgw.exe
2232	hdgw.exe
2960	hdgw.exe
448	hdgw.exe
2212	hdgw.exe
2488	hdgw.exe
896	hdgw.exe
1732	hdgw.exe
1632	hdgw.exe
1636	hdgw.exe
1072	hdgw.exe

Loads dropped DLL 2 IoCs

pid	Process
2356	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe
2356	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe

Suspicious use of SetThreadContext 25 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2688 set thread context of 2692	2688	hdgw.exe	32
PID 2876 set thread context of 2892	2876	hdgw.exe	36
PID 1548 set thread context of 1552	1548	hdgw.exe	38
PID 1768 set thread context of 2128	1768	hdgw.exe	40
PID 484 set thread context of 2092	484	hdgw.exe	42
PID 2228 set thread context of 2380	2228	hdgw.exe	44
PID 2108 set thread context of 2372	2108	hdgw.exe	46
PID 1776 set thread context of 1260	1776	hdgw.exe	48
PID 1684 set thread context of 1276	1684	hdgw.exe	50
PID 604 set thread context of 1240	604	hdgw.exe	52
PID 2296 set thread context of 700	2296	hdgw.exe	54
PID 2272 set thread context of 2056	2272	hdgw.exe	56
PID 2740 set thread context of 2676	2740	hdgw.exe	58
PID 2220 set thread context of 2932	2220	hdgw.exe	60
PID 1664 set thread context of 3012	1664	hdgw.exe	62
PID 3020 set thread context of 1880	3020	hdgw.exe	64
PID 1288 set thread context of 1760	1288	hdgw.exe	66
PID 1616 set thread context of 2280	1616	hdgw.exe	68
PID 2780 set thread context of 320	2780	hdgw.exe	70
PID 2232 set thread context of 2960	2232	hdgw.exe	72
PID 448 set thread context of 2212	448	hdgw.exe	74
PID 2488 set thread context of 896	2488	hdgw.exe	76
PID 1732 set thread context of 1632	1732	hdgw.exe	78
PID 1636 set thread context of 1072	1636	hdgw.exe	80

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdgw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2356	2624	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2688	2356	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	31
PID 2356 wrote to memory of 2688	2356	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	31
PID 2356 wrote to memory of 2688	2356	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	31
PID 2356 wrote to memory of 2688	2356	15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe	31
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2688 wrote to memory of 2692	2688	hdgw.exe	32
PID 2692 wrote to memory of 2528	2692	hdgw.exe	33
PID 2692 wrote to memory of 2528	2692	hdgw.exe	33
PID 2692 wrote to memory of 2528	2692	hdgw.exe	33
PID 2692 wrote to memory of 2528	2692	hdgw.exe	33
PID 2692 wrote to memory of 2528	2692	hdgw.exe	33
PID 2692 wrote to memory of 2528	2692	hdgw.exe	33
PID 2528 wrote to memory of 2876	2528	hdgw.exe	35
PID 2528 wrote to memory of 2876	2528	hdgw.exe	35
PID 2528 wrote to memory of 2876	2528	hdgw.exe	35
PID 2528 wrote to memory of 2876	2528	hdgw.exe	35
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2876 wrote to memory of 2892	2876	hdgw.exe	36
PID 2528 wrote to memory of 1548	2528	hdgw.exe	37
PID 2528 wrote to memory of 1548	2528	hdgw.exe	37
PID 2528 wrote to memory of 1548	2528	hdgw.exe	37
PID 2528 wrote to memory of 1548	2528	hdgw.exe	37
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 1548 wrote to memory of 1552	1548	hdgw.exe	38
PID 2528 wrote to memory of 1768	2528	hdgw.exe	39
PID 2528 wrote to memory of 1768	2528	hdgw.exe	39
PID 2528 wrote to memory of 1768	2528	hdgw.exe	39
PID 2528 wrote to memory of 1768	2528	hdgw.exe	39
PID 1768 wrote to memory of 2128	1768	hdgw.exe	40
PID 1768 wrote to memory of 2128	1768	hdgw.exe	40
PID 1768 wrote to memory of 2128	1768	hdgw.exe	40
PID 1768 wrote to memory of 2128	1768	hdgw.exe	40
PID 1768 wrote to memory of 2128	1768	hdgw.exe	40
PID 1768 wrote to memory of 2128	1768	hdgw.exe	40

C:\Users\Admin\AppData\Local\Temp\15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Roaming\hdgw.exe
    C:\Users\Admin\AppData\Local\Temp\15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe -dwup
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Roaming\hdgw.exe
      C:\Users\Admin\AppData\Local\Temp\15f1a4f226616e25120cc0f5cf660f4d_JaffaCakes118.exe -dwup
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2528
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2892
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1552
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2128
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2092
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2380
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2372
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1260
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1276
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:604
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1240
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:700
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2272
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2056
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2676
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2932
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:3012
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1880
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1760
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2280
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:320
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2960
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:2212
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:896
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1732
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1632
      - C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        
        C:\Users\Admin\AppData\Roaming\hdgw.exe
        7⤵
        Executes dropped EXE
        
        PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\hdgw.exe

Filesize
743KB

MD5
15f1a4f226616e25120cc0f5cf660f4d

SHA1
344b57cff93712c5003fb97f0fe6fb28e4f494c3

SHA256
cdbadc9abd00d0651339f0079dd86530a8ae5e7c86df8c1fec752a5e1a8ced60

SHA512
ac364746262ecb658368948d0036aad20ec5c22e4c53329d5fb3fc8ede42f542a2ddaf022fe3839d7c3c6effbe07159f0a4d70e8122fd167e53dc91d139a35d0

Download Submit
memory/2356-12-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2356-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2356-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2356-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2356-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2356-10-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2356-13-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2356-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2528-44-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2528-48-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2528-50-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2692-41-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2692-51-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2892-67-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads