bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b

General

Target
jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe
Size 42KB
Sample260925-2pp3tsycld
SHA256 bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b
MD5 32afe8aa227651a931cc5774eb7a8e28
SHA1 56c1c242848ff95064d3f111d63eb085afc5f5c6
SHA512 fc264ce81a912fba63677cd83706e2252059457d5c3e7bf1b3ee8bc21f1c100f1ae290eb3489e8f23969f3288ec5f23c96c4016e4370c3910f9e056546cec6e4
SSDEEP 768:GdjtoJ/3qpPtVfDRZq9EER9VUb/+09Im6vNJ4b/KjBV:GdaZ3q5A51F0Om+o/IV
TLSH
T1FD136D42768804B2E96A05307185BB33D72E34F416D79C4BBF92ECBA9E361513874F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}\StubPath = "C:\\WINDOWS\\system32\\mhzx.bat"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
5216	gameclien.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\mhzx.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzx.reg	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzxin.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\sougou.ime	gameclien.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe
File opened for modification	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5288	cmd.exe
4860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gameclien.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
5816	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4360	jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe
4360	jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe
5216	gameclien.exe
5216	gameclien.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 5288	4360	jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe	85
PID 5288 wrote to memory of 5216	5288	cmd.exe	87
PID 5216 wrote to memory of 4860	5216	gameclien.exe	88
PID 4860 wrote to memory of 5816	4860	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 1.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Program Files\WLmhzx\gameclien.exe
    "C:\Program Files\WLmhzx\gameclien.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\mhzxin.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit.exe /s mhzx.reg
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gameclien.exe

Path C:\Program Files\WLmhzx\gameclien.exe
Size 42KB
SHA256 bbcec85358106d2194d7b9b93b93eaed26172754f9f5f416af1472d68d16366b
MD5 32afe8aa227651a931cc5774eb7a8e28
SHA1 56c1c242848ff95064d3f111d63eb085afc5f5c6
SHA512 fc264ce81a912fba63677cd83706e2252059457d5c3e7bf1b3ee8bc21f1c100f1ae290eb3489e8f23969f3288ec5f23c96c4016e4370c3910f9e056546cec6e4
SSDEEP 768:GdjtoJ/3qpPtVfDRZq9EER9VUb/+09Im6vNJ4b/KjBV:GdaZ3q5A51F0Om+o/IV
TLSH
T1FD136D42768804B2E96A05307185BB33D72E34F416D79C4BBF92ECBA9E361513874F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Users\Admin\AppData\Local\Temp\1.bat
Size 256B
SHA256 3f07ac5bf3394a43a14337ff931995c6a7641a4ef578d8fb3b88ee50e82fde37
MD5 9e1115d315cfdd3ef84a5339abdddca4
SHA1 aff3f58e5bf8057cc18b8bc89c0cd9b115540111
SHA512 b513873ae98f795877bfad02834e2e4ffe7cb741480db0f8dd17279bbaaaa2482d7b29f6eca65652eeb9d07cb02ddeb768035a8def5492538a00ca6827109427
TLSH
T177D02B649692A3F341908DB3CF7CED0C53434161084F196493330A214E43932FF14501
MD5 SHA1 SHA512 TLSH

Submit Download

mhzxin.bat

Path C:\WINDOWS\SysWOW64\mhzxin.bat
Size 23B
SHA256 061b674b67a39109110ee8ff1b00e16e722edc6e6a16e6cb3183091015ec4e97
MD5 40ad273cddf8d446a6970e58e36c861e
SHA1 0096494c0a50ee9404e151ba9b0f22d14bbc2a30
SHA512 6aee175080408d992fc16ab260631696757670f0525dd56ae54994b08e63a6858d496a70241a84ea859d7a05ceab5acadea3880926af7052c7652755bdb03edf
MD5 SHA1 SHA512

Submit Download

mhzx.reg

Path C:\Windows\SysWOW64\mhzx.reg
Size 312B
SHA256 5c665746ab27624fa6b072e04aec98c0ffd8d78bdfa1efd67eeff92dce8dcb66
MD5 f0e79459e4b4ffcc8cb8b3e718fac9ff
SHA1 723bc34d7fad62fc56920d77f0a58fabe57ce049
SHA512 f8e394b54f0bb81be13db5b07543bb21372b461ee02499fb58f60b8216f6b24b8ad27381f7a494e67e7c4c31d285dfdfbb5cb89b604819351626e3a05c36d2ad
TLSH
T181E07D508E11E40150702301B6914CE33ED81BA294D7EE0860CAD4A56313FC2C62C8BF
MD5 SHA1 SHA512 TLSH

Submit Download

sougou.ime

Path C:\Windows\SysWOW64\sougou.ime
Size 36KB
SHA256 5b90e69f94ce5ef5e06f386b037bd70ece33ffeaaf54749f94b4cc71d76f0b69
MD5 fa97e880dcbae099fd4ef5367b3311be
SHA1 8d2ca55c0dfcb64e9d931690535dceb6b14694df
SHA512 e2e224e585f3734f19fc81f5d9006e7de47952932f911ead5a7541e56e1ff3aec56983fb2be6af68c8c074182ab2d4087084d8c4044f4d469d4ca70fbcf589c8
SSDEEP 768:soJ/3qpPtVfDRZq9EER9VUb/+09Im6vNJ4b/KjBV:9Z3q5A51F0Om+o/IV
TLSH
T1CEF25B5272C405B2ED6A46307495B736D72E34B426C3988BBF56ECBE9E371407830B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads