ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8

General

Target
jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe
Size 42KB
Sample260925-2prlnaaa99
SHA256 ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8
MD5 7213494917be91c98ab650fa69f09907
SHA1 27e1f037da269e55066ea0f57ba1548356f886a2
SHA512 b3394e93de165c372c45889299440857c90672c3999381bdddd2221befc4314f44503ff336291dc6dc05e376fb145e877fb490261ca496eb466aa339769f8efa
SSDEEP 768:tdl6OpzoRpYtVfDRZq9EER9VUt+9266vNJ4ZYKjxM:tdzJoRmA51nQ6+GYYM
TLSH
T15E136C42768805B2E95A05307085B733D72A34B426CB9C4BBF92ECBA9E371517474FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}\StubPath = "C:\\WINDOWS\\system32\\mhzx.bat"	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
1356	gameclien.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\mhzxin.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\sougou.ime	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzx.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzx.reg	gameclien.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe
File created	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2552	cmd.exe
864	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gameclien.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3216	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3052	jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe
3052	jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe
1356	gameclien.exe
1356	gameclien.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 864	3052	jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe	84
PID 864 wrote to memory of 1356	864	cmd.exe	86
PID 1356 wrote to memory of 2552	1356	gameclien.exe	87
PID 2552 wrote to memory of 3216	2552	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 1.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Program Files\WLmhzx\gameclien.exe
    "C:\Program Files\WLmhzx\gameclien.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\mhzxin.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit.exe /s mhzx.reg
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gameclien.exe

Path C:\Program Files\WLmhzx\gameclien.exe
Size 42KB
SHA256 ff3374d2478b9607330b46128ea609f84408683cf7d9a430831e79bd23fadbc8
MD5 7213494917be91c98ab650fa69f09907
SHA1 27e1f037da269e55066ea0f57ba1548356f886a2
SHA512 b3394e93de165c372c45889299440857c90672c3999381bdddd2221befc4314f44503ff336291dc6dc05e376fb145e877fb490261ca496eb466aa339769f8efa
SSDEEP 768:tdl6OpzoRpYtVfDRZq9EER9VUt+9266vNJ4ZYKjxM:tdzJoRmA51nQ6+GYYM
TLSH
T15E136C42768805B2E95A05307085B733D72A34B426CB9C4BBF92ECBA9E371517474FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Users\Admin\AppData\Local\Temp\1.bat
Size 256B
SHA256 e01063e52f0db62914f0e20649939f85adaf56fc99ae7d80716a312581ccee23
MD5 955f340f17864d31b2ced4670e5d6dbe
SHA1 2ed6cead3759cbf0f784886e50c5be5458dc2928
SHA512 02c7ef49a2bc45adbf5fc4f167c420d45cbc4824cdebcc39244762bd68dbd8474b23515a967e76af7760b8a5ef0f2c05533721b57ff5036d546daa443c7ea16c
TLSH
T149D05E5896015898A8BD290517E42AD1AA39C929355826AE926343AF9E23C26B390406
MD5 SHA1 SHA512 TLSH

Submit Download

mhzxin.bat

Path C:\WINDOWS\SysWOW64\mhzxin.bat
Size 23B
SHA256 061b674b67a39109110ee8ff1b00e16e722edc6e6a16e6cb3183091015ec4e97
MD5 40ad273cddf8d446a6970e58e36c861e
SHA1 0096494c0a50ee9404e151ba9b0f22d14bbc2a30
SHA512 6aee175080408d992fc16ab260631696757670f0525dd56ae54994b08e63a6858d496a70241a84ea859d7a05ceab5acadea3880926af7052c7652755bdb03edf
MD5 SHA1 SHA512

Submit Download

mhzx.reg

Path C:\Windows\SysWOW64\mhzx.reg
Size 312B
SHA256 5c665746ab27624fa6b072e04aec98c0ffd8d78bdfa1efd67eeff92dce8dcb66
MD5 f0e79459e4b4ffcc8cb8b3e718fac9ff
SHA1 723bc34d7fad62fc56920d77f0a58fabe57ce049
SHA512 f8e394b54f0bb81be13db5b07543bb21372b461ee02499fb58f60b8216f6b24b8ad27381f7a494e67e7c4c31d285dfdfbb5cb89b604819351626e3a05c36d2ad
TLSH
T181E07D508E11E40150702301B6914CE33ED81BA294D7EE0860CAD4A56313FC2C62C8BF
MD5 SHA1 SHA512 TLSH

Submit Download

sougou.ime

Path C:\Windows\SysWOW64\sougou.ime
Size 35KB
SHA256 fab0de471d595f7da73be863d491e0960c99983da74239f54b7d4267a46520bc
MD5 e1571941ff87eda27763c34e6e09c73c
SHA1 fd44b3931d5da35765b0fb4027e652f5b6aa174c
SHA512 4590ae142c2ddc62db533d5bd3d381f2361c27519feb727f242c38b6f435b73c0838bcfe8432d883e22e12f73e677e7dd1342c480f138af7f9a2246ca28b44c0
SSDEEP 768:zOpzoRpYtVfDRZq9EER9VUt+9266vNJ4ZYKjxM:yJoRmA51nQ6+GYYM
TLSH
T1D3F26D5272C805B3ED5A463074D5B772D72A34F425C3988ABF66ECBE9E370507820B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads