9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f

Analysis

max time kernel
84s
max time network
91s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
Size

2.4MB
MD5

635f9ee499f779b5f53c977916314d08
SHA1

1e0f9cc558a7d4271b0fcfdeec451e8b9902feca
SHA256

9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f
SHA512

0a1b6d8a6258f5cc595cc12ab61ba6f1214fb7d4a85f6bc265151f94df90205e81bd7338d14081c0617309eee4bda61ecbacc6312f574c4818d35d0c2930a060
SSDEEP

49152:vG3TrlDvrICBa2GawzcNQQoq8n+Fbi65FFy45R4h7XHIGfKETcn7e4:u3/5LU2Uzxq1biqy4G73KKcS4

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\usbhigh.sys	JSZS.exe
File opened for modification	C:\Windows\System32\Drivers\usbhigh.sys	JSZS.exe

Executes dropped EXE 2 IoCs

pid	Process
1352	JSZS.exe
1828	JSZS.exe

Loads dropped DLL 11 IoCs

pid	Process
1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
1352	JSZS.exe
1352	JSZS.exe
1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
1828	JSZS.exe
1828	JSZS.exe
1828	JSZS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\JiSuZhuShou\¼«ËÙÖúÊÖ.lnk	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\JSZS.exe	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\AdbWinApi.dll	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\usbhigh.sys	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\x64\usbhigh.sys	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\uninst.exe	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\JSHlp.exe	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\AdbWinUsbApi.dll	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
File created	C:\Program Files (x86)\JiSuZhuShou\adb.exe	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nvse.dat	JSZS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000700000001313e-65.dat	nsis_installer_1
behavioral1/files/0x000700000001313e-65.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	JSZS.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1352	JSZS.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1828	JSZS.exe
1828	JSZS.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1828	JSZS.exe
1828	JSZS.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1352	JSZS.exe
1828	JSZS.exe
1828	JSZS.exe
1828	JSZS.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1352	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	27
PID 1712 wrote to memory of 1352	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	27
PID 1712 wrote to memory of 1352	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	27
PID 1712 wrote to memory of 1352	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	27
PID 1712 wrote to memory of 1352	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	27
PID 1712 wrote to memory of 1352	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	27
PID 1712 wrote to memory of 1352	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	27
PID 1712 wrote to memory of 1828	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	28
PID 1712 wrote to memory of 1828	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	28
PID 1712 wrote to memory of 1828	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	28
PID 1712 wrote to memory of 1828	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	28
PID 1712 wrote to memory of 1828	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	28
PID 1712 wrote to memory of 1828	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	28
PID 1712 wrote to memory of 1828	1712	9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe	28

C:\Users\Admin\AppData\Local\Temp\9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe
"C:\Users\Admin\AppData\Local\Temp\9ca99144e81ddcabdacd496649a200512ec43dd9589f81876add79272509a34f.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\JSZS.exe
  C:\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\JSZS.exe /fix
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1352
- C:\Program Files (x86)\JiSuZhuShou\JSZS.exe
  "C:\Program Files (x86)\JiSuZhuShou\JSZS.exe" /A
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
C:\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
C:\Program Files (x86)\JiSuZhuShou\x64\usbhigh.sys

Filesize
331KB

MD5
0c2ccb3287db8c0bca93569461b97e9f

SHA1
0c0ac0ddec5ecc8a065215310a1cd7da28ae3195

SHA256
7615f6b3c8ee53ed8d12fae8f1233bb09f9268fb8cda112fc417e4ca66266c78

SHA512
2baa8a69fe76d9e0fc91166587d0dc5ede1b608c663ccfd9fded9a5925a005d23967a3910a7606d360d304d95e4825527a707482d8387e8774f697ba998b020b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Program Files (x86)\JiSuZhuShou\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Program Files (x86)\JiSuZhuShou\uninst.exe

Filesize
60KB

MD5
e3ad0e2f3cea4a0e0405714110fdc153

SHA1
4da9ab540186feb1d0494fadfe860931bae094ba

SHA256
07fda6f91268c634fb03db8dd32a46cd549c9073074a5b1577fa9551282cc827

SHA512
bea96324ef793da66d1cb119648af3bb37860dc205ccf980dce10a87dac42ab8092666fb4ca99c1adfb133b8e10aecf3d108e6e1bf3b622af1c70c97521d12c7

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\JSZS.exe

Filesize
2.4MB

MD5
b2f8ceece66738781650a4a951806159

SHA1
ae4b1ffc215bd1e1bb38bd4b8558f9614f29df5c

SHA256
5ddba0fe23e044aa733afea8f655f2633c1cfb9d276d1991383b66a60dbfb8b7

SHA512
71eb871c3fc94cda37f530433575c46120ce5cc10a9fccb414a711f7a88bf68ccd17a9d9f43eb0e5fc68e1a5b935d2e3b062b735a1c161fb624632cb66a5ad28

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1B11.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
memory/1712-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download