f5773e3b4f75a2f4b47f6335b9c115e5f5fcc0afa6e58a63a7a5aa6366237dc0

General

Target

172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe
Size

2.5MB
MD5

172899e62d0331bb1ec9fcb4aa369476
SHA1

693d785158a9e867e31cc0b33c0124bf2bf67afe
SHA256

f5773e3b4f75a2f4b47f6335b9c115e5f5fcc0afa6e58a63a7a5aa6366237dc0
SHA512

2350f2f4efa4379cb0a7837617b3d0d0a583f12165f479149616d46e207963380dc55c5b2e432ff9563f51f8ac8c88de4f99ba6ab2cef9db040cff81e31cc85a
SSDEEP

49152:iw63Ea615lBOtrEkaT+XDnlIq/Wnlm3YZXrX1cHT7rGhYYKAS5ASVK:Y7615ErfaTj0lOXrSHTOYYKAS5ASQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	mdthrgmfwz.exe

Loads dropped DLL 3 IoCs

pid	Process
2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe
2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe
2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mdthrgmfwz.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	mdthrgmfwz.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe
2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	mdthrgmfwz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	mdthrgmfwz.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2692	mdthrgmfwz.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe
2692	mdthrgmfwz.exe
2692	mdthrgmfwz.exe
2692	mdthrgmfwz.exe
2692	mdthrgmfwz.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2692	2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe	32
PID 2904 wrote to memory of 2692	2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe	32
PID 2904 wrote to memory of 2692	2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe	32
PID 2904 wrote to memory of 2692	2904	172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\172899e62d0331bb1ec9fcb4aa369476_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Roaming\wangame\mdthrgmfwz\mdthrgmfwz.exe
  "C:\Users\Admin\AppData\Roaming\wangame\mdthrgmfwz\mdthrgmfwz.exe" ns
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wangame\mdthrgmfwz\static.ini

Filesize
151B

MD5
f09d19f19e1eca96e23d3f46a8b8f089

SHA1
da5437e3d22f020202acec335eb741c23f9de250

SHA256
45bd67dd5f486906b6cbb49da3377395ee8e5a3e63dd6ecc8c1a4f82bdee9f41

SHA512
0d8aa6477abfc8b75d7bab3d6c41960cfcab96a1c2792a105b0548b57ffa2f16e17e8489f9f7aa8349ae40b87c4b73c49191e90e2cc6c070f15b02e3d8f087a7

Download Submit
C:\Users\Admin\AppData\Roaming\wangame\mdthrgmfwz\魔法王座.lnk

Filesize
974B

MD5
a3bd8b287ba3c08954be86780029194b

SHA1
92e87a5d3bfdefdcfbc1adac0b66289bbd138426

SHA256
616120e75e8a01ea4c21c751e9653e4101ae87b4ac56fb9e46766957b078563d

SHA512
8b6d9fdd103da1611de36b82fb9459c8984849dfe49e7f21bac66f0c35b2f6ce27ebc76b38fe9597b3f97850db472c6598732916a6872739d510372a78750f33

Download Submit
\Users\Admin\AppData\Roaming\wangame\mdthrgmfwz\mdthrgmfwz.exe

Filesize
2.5MB

MD5
172899e62d0331bb1ec9fcb4aa369476

SHA1
693d785158a9e867e31cc0b33c0124bf2bf67afe

SHA256
f5773e3b4f75a2f4b47f6335b9c115e5f5fcc0afa6e58a63a7a5aa6366237dc0

SHA512
2350f2f4efa4379cb0a7837617b3d0d0a583f12165f479149616d46e207963380dc55c5b2e432ff9563f51f8ac8c88de4f99ba6ab2cef9db040cff81e31cc85a

Download Submit

Analysis

Sharing