Analysis
-
max time kernel
125s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
2a32d59033987e44506dbe9ab04d534c
-
SHA1
1ba5b7c12547d2500820e03ab73097b097e305ad
-
SHA256
ee77f0509aec326d0397600440f4d5e7f0b05de8aead2d6ed067a8a1b18cdfe3
-
SHA512
044d05aca28d205cbaff381317b34a8d93a7846dcb2be31d74c370f7c55dacdfe1c17d264e9d33668588d836b7446e462be855cd48f3aa31cfd3111e58472233
-
SSDEEP
49152:6ffy4NwrQoDE0uaXxl9LC2v2UZGglxh5ozMP4NQQOSr5k/I4XTZGfVuK:6ffyvuM9LCC2UfYz24NQdWC/IgT3K
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation maxthon.exe -
Executes dropped EXE 5 IoCs
pid Process 4488 hahagame.exe 3512 game.exe 2568 maxthon.exe 3596 hahagame.tmp 3688 download.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language game.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language maxthon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language download.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hahagame.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hahagame.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Kills process with taskkill 2 IoCs
pid Process 2420 taskkill.exe 3672 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliyun.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100cf617481adb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0038fd17481adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliyun.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31136328" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136328" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136328" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "316694247" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e006ad27481adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "316694247" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435242423" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136328" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb73de6dedeff944803e966ed3363124000000000200000000001066000000010000200000004257d576f33fb6357a8b28d01357db1486830a7c3888e32cfdc74941df8c8c73000000000e80000000020000200000007d91917d6845ccde4e615e948fc5196a1772213eaabd65b183a31a23a51ca2c8200000000090ebff67f46d17adb82683656a313597004357bb60ca213975c90d585c8df540000000ea79d714a194edff6665e28733f9ee2ee2ac47795b1b44cfbaf04c45f3c64557e25a6b8fd944e2722912192f541ead6e63619234e6c0867dafa38a8d55a3ea9a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliyun.com\Total = "34" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "316225376" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31136328" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "320131747" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wanwang.aliyun.com\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "316225376" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lnkfile game.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2420 taskkill.exe Token: SeDebugPrivilege 3672 taskkill.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 2576 iexplore.exe 1508 iexplore.exe 1508 iexplore.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 1508 iexplore.exe 1508 iexplore.exe 2576 iexplore.exe 2576 iexplore.exe 3688 download.exe 5008 IEXPLORE.EXE 5008 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 1508 iexplore.exe 1508 iexplore.exe 2244 IEXPLORE.EXE 2244 IEXPLORE.EXE 2244 IEXPLORE.EXE 2244 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4488 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 86 PID 1436 wrote to memory of 4488 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 86 PID 1436 wrote to memory of 4488 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 86 PID 1436 wrote to memory of 3512 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 87 PID 1436 wrote to memory of 3512 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 87 PID 1436 wrote to memory of 3512 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 87 PID 1436 wrote to memory of 2568 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 88 PID 1436 wrote to memory of 2568 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 88 PID 1436 wrote to memory of 2568 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 88 PID 1436 wrote to memory of 1508 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 89 PID 1436 wrote to memory of 1508 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 89 PID 1436 wrote to memory of 2576 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 90 PID 1436 wrote to memory of 2576 1436 2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe 90 PID 4488 wrote to memory of 3596 4488 hahagame.exe 91 PID 4488 wrote to memory of 3596 4488 hahagame.exe 91 PID 4488 wrote to memory of 3596 4488 hahagame.exe 91 PID 2576 wrote to memory of 2884 2576 iexplore.exe 93 PID 2576 wrote to memory of 2884 2576 iexplore.exe 93 PID 2576 wrote to memory of 2884 2576 iexplore.exe 93 PID 1508 wrote to memory of 5008 1508 iexplore.exe 92 PID 1508 wrote to memory of 5008 1508 iexplore.exe 92 PID 1508 wrote to memory of 5008 1508 iexplore.exe 92 PID 2568 wrote to memory of 3688 2568 maxthon.exe 94 PID 2568 wrote to memory of 3688 2568 maxthon.exe 94 PID 2568 wrote to memory of 3688 2568 maxthon.exe 94 PID 3688 wrote to memory of 2872 3688 download.exe 100 PID 3688 wrote to memory of 2872 3688 download.exe 100 PID 3688 wrote to memory of 2872 3688 download.exe 100 PID 3688 wrote to memory of 4072 3688 download.exe 102 PID 3688 wrote to memory of 4072 3688 download.exe 102 PID 3688 wrote to memory of 4072 3688 download.exe 102 PID 4072 wrote to memory of 2712 4072 iexplore.exe 103 PID 4072 wrote to memory of 2712 4072 iexplore.exe 103 PID 1508 wrote to memory of 2244 1508 iexplore.exe 104 PID 1508 wrote to memory of 2244 1508 iexplore.exe 104 PID 1508 wrote to memory of 2244 1508 iexplore.exe 104 PID 3688 wrote to memory of 2420 3688 download.exe 106 PID 3688 wrote to memory of 2420 3688 download.exe 106 PID 3688 wrote to memory of 2420 3688 download.exe 106 PID 3688 wrote to memory of 3672 3688 download.exe 111 PID 3688 wrote to memory of 3672 3688 download.exe 111 PID 3688 wrote to memory of 3672 3688 download.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2a32d59033987e44506dbe9ab04d534c_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\hahagame.exeC:\hahagame.exe /sp- /silent /norestart /verysilent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\is-HIDV7.tmp\hahagame.tmp"C:\Users\Admin\AppData\Local\Temp\is-HIDV7.tmp\hahagame.tmp" /SL5="$D0068,1630806,72704,C:\hahagame.exe" /sp- /silent /norestart /verysilent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3596
-
-
-
C:\game.exeC:\game.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3512
-
-
C:\maxthon.exeC:\maxthon.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\todeletetif.bat4⤵
- System Location Discovery: System Language Discovery
PID:2872
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://www.hahayouxi.com/act/ConfigDownLoadList.html4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.hahayouxi.com/act/ConfigDownLoadList.html5⤵
- Modifies Internet Explorer settings
PID:2712
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 40724⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 04⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.jipinla.com2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5008
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:17416 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2244
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.1234.la/an.htm?tianji2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3E450467-863B-11EF-B9B6-4A034D48373C}.dat
Filesize5KB
MD5da0641d072b77009faec0e1fe318f237
SHA1b8ee750bccf4fd131478145a9feb542d3737e079
SHA256bc9823fe53056649c99e1fbebcec3b449528873792e69658475966d61960797c
SHA512628731c02a46fe7487bfc192ec8bf6ae2d575996235ab180270eafd7ee8a1f2106c3239d4c1039223bf46579e4e69d5c3a33e8bf7f930c243a26e2e8ac7edd9b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3E49C8AE-863B-11EF-B9B6-4A034D48373C}.dat
Filesize4KB
MD55f52706bb2f36ec0d097563692472e7c
SHA18545affe664f381b67f0b640ead2ac941286f8ae
SHA256a3122bb995632cafd6440cc4339d7567a7d5c96b81a817a693a66a345972e381
SHA5125a3f721bf3bdbad4c7c29cbd26edd89e1565dd9c9e021cfc370b8a2d38be4e95499fdc08182319c4375f5cc96507ffc1a52b943fa4a03a28c5585ab76eca6163
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
1.8MB
MD50b80274947513ef334429c0c666b3c53
SHA1eb8f8ea8b3dc913c361adcfa4f790935083c4bf9
SHA2564e9864adbc4b7c31cb8c1a81bb4a396459ab456640307d820f1f5d9f29e341be
SHA51207ad09b3a021effce8cf696ac3e15be276d26e0b8d983fd64647fbac71a749a158c5b02e8399fa4c008d4a5517c2befbc3e84e02be803f0dd1f169da72fd5213
-
Filesize
44KB
MD51e61219ddacbfc81d6459142ce054085
SHA1230216b0deca51883c62c3735a11191c6fa94887
SHA256f3deeafe0b5b9828c118f67d7f89f7da0d41b0189025998b28f6d63f51507774
SHA5123ad181a849f7344094a0cdff71d54338318bd3440ff2c0bde6c1d158ca954b273b1f6388b54044b5d92d9cec7c8b3e260de94f0a5ac80136ba17d2bd2c5b960d
-
Filesize
682KB
MD5d0699dfc3ff2c8980f167c7ab586dfcc
SHA1c3f4aa0a542c01a0251782e48b313cbb7c5941a7
SHA25652361d23cd961a2918dd0ca57306bb9d1cf9aa65f518d2b4d11147ef1f657175
SHA512ea55708ba81207a55dfaf8e4ab77e837086d83b27c185942ce6b228f0844d4dc3e26cddd39cfda60ebf34a4f449e563f47ad46ba72e45a133e898e2a038fbf69
-
Filesize
95B
MD5cd490fc0b8299edb479fe88c9245808a
SHA163ef98f15756c129ac1977864c845d90c427881b
SHA25630baa4c3ad9a57399678728d9cfd8fb2456005b794e45df84383c115e357e0d6
SHA512efd2077ad9b62ff946f9943d435c12a07e598a074026c0ba3e50db1f96aae6fa484d10c3048bd91855bbd7b7cf6c439082678709eec0d5a8012e4c3fca7faf38
-
Filesize
192B
MD533a5aee5a69c397ad77983a0602a3ddf
SHA189e7d9644da6f1720a5f53309919275b112e2107
SHA25624a22458397e71142c529c01146d5d3c46b75eac8f40dd7e3360436e909f00b6
SHA512d5881679ab675f3f052f157e9a22d962cb2a0f9baa132b1c05689e7ea835541c19a7b207733891c08cf69cf9b9e8ceb9d5c8a5ffa7795dcba8229c0b07e4fb72
-
Filesize
111KB
MD538ce47aaacb8f1cb7169bda66f62298d
SHA18571d7e86810e0a17ae7d73c6ed4e7027a62359c
SHA256d83e27fca97e80ed4842fa7a9b73fb63ba5cf0a1f959dd39a966398319c243c2
SHA51283e44f4071cb983da68f4adb97db182a60f9347a8c8a5e6d339f5d78d4e53981f7bcdb57a49bf421ab8300a72b316a24b3e0b291f3f64384f8a71fc7b0496dca
-
Filesize
159KB
MD57bce9c46da8425ef61167f87e69cb53f
SHA17eaebc37924cfd6f166549aaaf063985017cce62
SHA2561ad7a77aae1cf61a4d72cb381310d6222b46d94707372a3a5dfe03923c2971a7
SHA5128ac9315b32654d77f675931ff257cb631a1bca7b4b905b12f1e4490c6b053f96d4989740e5e9631de2f027df51871a8dca5d506d8ca0e3e1faa3060b2ae76783