151cd8baf5f35af4728d56699c394242c47895f6ccbe5e27da173e127cb30fc1

General

Target

4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
Size

2.5MB
MD5

4b8d0958dfa0148186a6cd4cf1d07e28
SHA1

bbae983c2d1043070dacbb36eccc4f5baf1fca1f
SHA256

151cd8baf5f35af4728d56699c394242c47895f6ccbe5e27da173e127cb30fc1
SHA512

50473159ddeb799b6fd37540b7d9b836d03c68932666f0e716b8dc35821066a43650306bc47a434db06dd687fa8c583a06b11d88ed8e8ae4bdc133a95cab5ce8
SSDEEP

49152:S/s1bL1KDlxhFMlUMQ6F4O1g30OzwkCgxXFbi65FFy45R4h7XHIGfKETcn7e5bc9:QeYRxbMlUM3Xg3GSx1biqy4G73KKcShm

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Drivers\usbhigh.sys	JSZS.exe
File created	C:\Windows\System32\Drivers\usbhigh.sys	JSZS.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a00000001224c-4.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2992	JSZS.exe
2464	JSZS.exe

Loads dropped DLL 13 IoCs

pid	Process
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2992	JSZS.exe
2992	JSZS.exe
2992	JSZS.exe
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2464	JSZS.exe
2464	JSZS.exe
2464	JSZS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\JiSuZhuShou\adb.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\¼«ËÙÖúÊÖ.lnk	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\AdbWinApi.dll	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\usbhigh.sys	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\x64\usbhigh.sys	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\uninst.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\JSZS.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\JSHlp.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\AdbWinUsbApi.dll	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nvse.dat	JSZS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000600000001610f-38.dat	nsis_installer_1
behavioral1/files/0x000600000001610f-38.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	JSZS.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2992	JSZS.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
484	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2464	JSZS.exe
2464	JSZS.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2464	JSZS.exe
2464	JSZS.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
2992	JSZS.exe
2464	JSZS.exe
2464	JSZS.exe
2464	JSZS.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2992	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2992	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2992	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2992	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2992	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2992	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2992	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2464	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	29
PID 2980 wrote to memory of 2464	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	29
PID 2980 wrote to memory of 2464	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	29
PID 2980 wrote to memory of 2464	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	29
PID 2980 wrote to memory of 2464	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	29
PID 2980 wrote to memory of 2464	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	29
PID 2980 wrote to memory of 2464	2980	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\nst1E2E.tmp\JSZS.exe
  C:\Users\Admin\AppData\Local\Temp\nst1E2E.tmp\JSZS.exe /fix
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2992
- C:\Program Files (x86)\JiSuZhuShou\JSZS.exe
  "C:\Program Files (x86)\JiSuZhuShou\JSZS.exe" /A
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\JiSuZhuShou\uninst.exe

Filesize
60KB

MD5
3a253bec343d30fc6d76460c130a12fe

SHA1
bd007d13ce26ecbe430a4eb4e8c24c7236d833a9

SHA256
dfcc76f4748061cec60e289b1490df910728e1a0dd44fc9eb00572210e8a7737

SHA512
4662fa878f95c8663b2800b46d72e6590a7b1c57cf64a387e261e1b65a1d21ed99ad16268900829ddcc2b8b3dfba5aec843aeda1382a936c057666cf7fb5d669

Download Submit
C:\Program Files (x86)\JiSuZhuShou\x64\usbhigh.sys

Filesize
331KB

MD5
0c2ccb3287db8c0bca93569461b97e9f

SHA1
0c0ac0ddec5ecc8a065215310a1cd7da28ae3195

SHA256
7615f6b3c8ee53ed8d12fae8f1233bb09f9268fb8cda112fc417e4ca66266c78

SHA512
2baa8a69fe76d9e0fc91166587d0dc5ede1b608c663ccfd9fded9a5925a005d23967a3910a7606d360d304d95e4825527a707482d8387e8774f697ba998b020b

Download Submit
\Users\Admin\AppData\Local\Temp\nst1E2E.tmp\JSZS.exe

Filesize
2.4MB

MD5
d15c35e491675bb98a7824dcf7cfa7e7

SHA1
77f1fd00b0d0a085353c3d83b0b5183aacc623ea

SHA256
4badfcba4996371c89d5871e5cc8311bce6cecf917627337f86b4f85178b6875

SHA512
7bf1ea3fbcab5296b28a7e8c60816a722685b2a04bf33b001c6fed584ad16963f7832f6de6d83449a6a9be6c37392e16c0bae09804aea0c408389179540333bb

Download Submit
\Users\Admin\AppData\Local\Temp\nst1E2E.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\ucl1DCD.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/2464-78-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/2980-6-0x00000000007F0000-0x0000000000863000-memory.dmp

Filesize
460KB

Download
memory/2980-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2980-2-0x0000000000890000-0x00000000008D6000-memory.dmp

Filesize
280KB

Download
memory/2980-63-0x00000000007F0000-0x0000000000863000-memory.dmp

Filesize
460KB

Download
memory/2980-62-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2980-3-0x0000000000890000-0x00000000008D6000-memory.dmp

Filesize
280KB

Download
memory/2992-27-0x0000000000690000-0x0000000000703000-memory.dmp

Filesize
460KB

Download
memory/2992-30-0x0000000000690000-0x0000000000703000-memory.dmp

Filesize
460KB

Download
memory/2992-28-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing