b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f

General

Target
jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe
Size 37KB
Sample260925-2repwaycpg
SHA256 b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f
MD5 a6d343b5f094c8644081b2b56cca2e98
SHA1 35bbe2b656f5b94d2121549aafe21a4c4e1e5f1f
SHA512 e3b61c97e78675d6843b6ebbb291f6c8159b9266bdd2372e4952766c4c9eb11fd154f3f9451997c81629f160aabe3160fcaaf8de13eb6918644ce9100ee08567
SSDEEP 768:S9IKn55py5yW78YZz2CuJqX0JfjBH9VnsFJ+R24X7csRfK:S9IKn5tg8Y4J7FnxRv1f
TLSH
T1C1035C632A9504B2D56A82307586FB36C73F34B026939C4777E6E87B9C3B1513970E8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12345678-b1gf-14d0-89bb-0090ce808666}\StubPath = "C:\\WINDOWS\\system32\\mhzx.bat"	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
4572	gameclien.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\mhzxin.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\sougou.ime	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzx.bat	gameclien.exe
File created	C:\WINDOWS\SysWOW64\mhzx.reg	gameclien.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe
File opened for modification	C:\Program Files\WLmhzx\gameclien.exe	jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
2380	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gameclien.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3264	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1128	jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe
1128	jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe
4572	gameclien.exe
4572	gameclien.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4908	1128	jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe	86
PID 4908 wrote to memory of 4572	4908	cmd.exe	88
PID 4572 wrote to memory of 2380	4572	gameclien.exe	89
PID 2380 wrote to memory of 3264	2380	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 1.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Program Files\WLmhzx\gameclien.exe
    "C:\Program Files\WLmhzx\gameclien.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\mhzxin.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit.exe /s mhzx.reg
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gameclien.exe

Path C:\Program Files\WLmhzx\gameclien.exe
Size 37KB
SHA256 b158bf39d8fb47c7344707465d2ba53a17c4686a74d8ecbdeb22047de0cd247f
MD5 a6d343b5f094c8644081b2b56cca2e98
SHA1 35bbe2b656f5b94d2121549aafe21a4c4e1e5f1f
SHA512 e3b61c97e78675d6843b6ebbb291f6c8159b9266bdd2372e4952766c4c9eb11fd154f3f9451997c81629f160aabe3160fcaaf8de13eb6918644ce9100ee08567
SSDEEP 768:S9IKn55py5yW78YZz2CuJqX0JfjBH9VnsFJ+R24X7csRfK:S9IKn5tg8Y4J7FnxRv1f
TLSH
T1C1035C632A9504B2D56A82307586FB36C73F34B026939C4777E6E87B9C3B1513970E8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Users\Admin\AppData\Local\Temp\1.bat
Size 257B
SHA256 3175c592d82019ac5e9ca4897ad93d473bb45c286e81063a5c9acbda7dbeb04d
MD5 cb3286eb4f6bd8387a8deed1a61d34e9
SHA1 ac232b0fb5029ac2d8ff487e54c64f05125ea1cb
SHA512 beb68965c0ccfc8f9568ff343a6be353ca6ae1866d6820dec8e323c43cd45bd9f8773a80b5b4fce4f84dc5f0c8b058311a5ac305031d2e6640e75b4e4329a6ea
TLSH
T113D0A7F9446680C3B8C6DB41572D1F01B31BC3DB148C2CE793A387E9FE236299369584
MD5 SHA1 SHA512 TLSH

Submit Download

mhzxin.bat

Path C:\WINDOWS\SysWOW64\mhzxin.bat
Size 23B
SHA256 061b674b67a39109110ee8ff1b00e16e722edc6e6a16e6cb3183091015ec4e97
MD5 40ad273cddf8d446a6970e58e36c861e
SHA1 0096494c0a50ee9404e151ba9b0f22d14bbc2a30
SHA512 6aee175080408d992fc16ab260631696757670f0525dd56ae54994b08e63a6858d496a70241a84ea859d7a05ceab5acadea3880926af7052c7652755bdb03edf
MD5 SHA1 SHA512

Submit Download

mhzx.reg

Path C:\Windows\SysWOW64\mhzx.reg
Size 312B
SHA256 5c665746ab27624fa6b072e04aec98c0ffd8d78bdfa1efd67eeff92dce8dcb66
MD5 f0e79459e4b4ffcc8cb8b3e718fac9ff
SHA1 723bc34d7fad62fc56920d77f0a58fabe57ce049
SHA512 f8e394b54f0bb81be13db5b07543bb21372b461ee02499fb58f60b8216f6b24b8ad27381f7a494e67e7c4c31d285dfdfbb5cb89b604819351626e3a05c36d2ad
TLSH
T181E07D508E11E40150702301B6914CE33ED81BA294D7EE0860CAD4A56313FC2C62C8BF
MD5 SHA1 SHA512 TLSH

Submit Download

sougou.ime

Path C:\Windows\SysWOW64\sougou.ime
Size 32KB
SHA256 7d79970bac77ad7ab095503df6a1ed6928c11197fd5114fe80d0c5d4117854d2
MD5 4c1b87209dd1710f4ef7239336748003
SHA1 943c60c12526c7e8899910b3af6732b0c0370b95
SHA512 62e7893e99654a7fa75dee4ede98f2f02e1de9aedbbd0146bd4862dfb348aaa3a5ea4a58dc534deb1a29444cb8a33a4974a78d7d4ee2a332c2ebc37b0e6aa231
SSDEEP 768:Uy5yW78YZz2CuJqX0JfjBH9VnsFJ+R24X7csRfK:wg8Y4J7FnxRv1f
TLSH
T1A0E24C62168504B2E97A82307486FF35873F34F42693985BBBE6E87F582B1513970F87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads