302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b

General

Target
jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe
Size 42KB
Sample260925-2plemsaa97
SHA256 302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b
MD5 837ec0b4137740162b6cbd3754638fb2
SHA1 5d0340b1b3e15292ef537c2da421b7df69537852
SHA512 79fb9b597ff9865996a6d58b77b88ee901d891ac732a7335b9841a69a9f877d6aef6583e6b1ea58f3362401f12d0fd410837eef24f9914be45b40ca9f4a0c00f
SSDEEP 768:GdjtoJ/3qpPtVfDRZq9EER9VUb/+09Im6vNJ4c/KjBV:GdaZ3q5A51F0Om+n/IV
TLSH
T1EF136D42768804B2E96A05307185B733D72E34F416D79C4BBF92ECBA9E361513874F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}\StubPath = "C:\\WINDOWS\\system32\\mhzx.bat"	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
2432	gameclien.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\mhzx.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzx.reg	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzxin.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\sougou.ime	gameclien.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe
File opened for modification	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3208	cmd.exe
5208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gameclien.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
364	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4352	jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe
4352	jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe
2432	gameclien.exe
2432	gameclien.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3208	4352	jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe	89
PID 3208 wrote to memory of 2432	3208	cmd.exe	91
PID 2432 wrote to memory of 5208	2432	gameclien.exe	92
PID 5208 wrote to memory of 364	5208	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 1.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Program Files\WLmhzx\gameclien.exe
    "C:\Program Files\WLmhzx\gameclien.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\mhzxin.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5208
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit.exe /s mhzx.reg
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gameclien.exe

Path C:\Program Files\WLmhzx\gameclien.exe
Size 42KB
SHA256 302cf3fb7d0fb57b839d880ec3310534487d25a8afad3c6e75da14ad455ffc9b
MD5 837ec0b4137740162b6cbd3754638fb2
SHA1 5d0340b1b3e15292ef537c2da421b7df69537852
SHA512 79fb9b597ff9865996a6d58b77b88ee901d891ac732a7335b9841a69a9f877d6aef6583e6b1ea58f3362401f12d0fd410837eef24f9914be45b40ca9f4a0c00f
SSDEEP 768:GdjtoJ/3qpPtVfDRZq9EER9VUb/+09Im6vNJ4c/KjBV:GdaZ3q5A51F0Om+n/IV
TLSH
T1EF136D42768804B2E96A05307185B733D72E34F416D79C4BBF92ECBA9E361513874F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Users\Admin\AppData\Local\Temp\1.bat
Size 256B
SHA256 e6b27a0b4acbac5579efe9080ba5b94069ddd9910372b8110a451bd206f713d0
MD5 b0b3451ea75941e0fba9de5f56a69d69
SHA1 1e37a83fa05ac4adb968f04c4245c6522056c54e
SHA512 3be117f373814e0be7b8ec702d94ab64c57fb3e6215e95c5d5d837032c1896f0693fafbfb6b19d5f9b2f68515856f469e754177f8aed9cf97587c12685662699
TLSH
T1FDD05B886387B0A21441AC018F382B4B91868517140C165F96730B956E8B7227756A48
MD5 SHA1 SHA512 TLSH

Submit Download

mhzxin.bat

Path C:\WINDOWS\SysWOW64\mhzxin.bat
Size 23B
SHA256 061b674b67a39109110ee8ff1b00e16e722edc6e6a16e6cb3183091015ec4e97
MD5 40ad273cddf8d446a6970e58e36c861e
SHA1 0096494c0a50ee9404e151ba9b0f22d14bbc2a30
SHA512 6aee175080408d992fc16ab260631696757670f0525dd56ae54994b08e63a6858d496a70241a84ea859d7a05ceab5acadea3880926af7052c7652755bdb03edf
MD5 SHA1 SHA512

Submit Download

mhzx.reg

Path C:\Windows\SysWOW64\mhzx.reg
Size 312B
SHA256 5c665746ab27624fa6b072e04aec98c0ffd8d78bdfa1efd67eeff92dce8dcb66
MD5 f0e79459e4b4ffcc8cb8b3e718fac9ff
SHA1 723bc34d7fad62fc56920d77f0a58fabe57ce049
SHA512 f8e394b54f0bb81be13db5b07543bb21372b461ee02499fb58f60b8216f6b24b8ad27381f7a494e67e7c4c31d285dfdfbb5cb89b604819351626e3a05c36d2ad
TLSH
T181E07D508E11E40150702301B6914CE33ED81BA294D7EE0860CAD4A56313FC2C62C8BF
MD5 SHA1 SHA512 TLSH

Submit Download

sougou.ime

Path C:\Windows\SysWOW64\sougou.ime
Size 36KB
SHA256 39aa7739a824050cf69f5e0e1eaa307c832f67b92d8026deae17e131edbfaf3d
MD5 6a4ab38feb3cfb8fd43ed36f8a1c54b6
SHA1 8bb304291d3ffef9d7ea1a12efa5c8455af6ff96
SHA512 bf7d6035d16fd4fd2287a31300ade3ecad36db3818af646c45601b1c0b79d8799add551e109b4a67d1590c4f763333bbfe271911f698e6959bad483f22824db6
SSDEEP 768:soJ/3qpPtVfDRZq9EER9VUb/+09Im6vNJ4c/KjBV:9Z3q5A51F0Om+n/IV
TLSH
T192F25B5272C405B2ED6A46307495B736D72E34B426C3988BBF56ECBE9E371407830B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads