151cd8baf5f35af4728d56699c394242c47895f6ccbe5e27da173e127cb30fc1

General

Target

4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
Size

2.5MB
MD5

4b8d0958dfa0148186a6cd4cf1d07e28
SHA1

bbae983c2d1043070dacbb36eccc4f5baf1fca1f
SHA256

151cd8baf5f35af4728d56699c394242c47895f6ccbe5e27da173e127cb30fc1
SHA512

50473159ddeb799b6fd37540b7d9b836d03c68932666f0e716b8dc35821066a43650306bc47a434db06dd687fa8c583a06b11d88ed8e8ae4bdc133a95cab5ce8
SSDEEP

49152:S/s1bL1KDlxhFMlUMQ6F4O1g30OzwkCgxXFbi65FFy45R4h7XHIGfKETcn7e5bc9:QeYRxbMlUM3Xg3GSx1biqy4G73KKcShm

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\usbhigh.sys	JSZS.exe
File opened for modification	C:\Windows\System32\Drivers\usbhigh.sys	JSZS.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022fa8-2.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
3004	JSZS.exe
3624	JSZS.exe

Loads dropped DLL 5 IoCs

pid	Process
4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
3004	JSZS.exe
3004	JSZS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\JiSuZhuShou\JSZS.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\JSHlp.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\adb.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\x64\usbhigh.sys	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\uninst.exe	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\AdbWinUsbApi.dll	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\AdbWinApi.dll	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\usbhigh.sys	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
File created	C:\Program Files (x86)\JiSuZhuShou\¼«ËÙÖúÊÖ.lnk	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nvse.dat	JSZS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x00070000000234a8-37.dat	nsis_installer_1
behavioral2/files/0x00070000000234a8-37.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	JSZS.exe
3004	JSZS.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
3004	JSZS.exe
3624	JSZS.exe
3624	JSZS.exe
3624	JSZS.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3004	4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	84
PID 4040 wrote to memory of 3004	4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	84
PID 4040 wrote to memory of 3004	4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	84
PID 4040 wrote to memory of 3624	4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	88
PID 4040 wrote to memory of 3624	4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	88
PID 4040 wrote to memory of 3624	4040	4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b8d0958dfa0148186a6cd4cf1d07e28_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\nsc5845.tmp\JSZS.exe
  C:\Users\Admin\AppData\Local\Temp\nsc5845.tmp\JSZS.exe /fix
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3004
- C:\Program Files (x86)\JiSuZhuShou\JSZS.exe
  "C:\Program Files (x86)\JiSuZhuShou\JSZS.exe" /A
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\JiSuZhuShou\uninst.exe

Filesize
60KB

MD5
3a253bec343d30fc6d76460c130a12fe

SHA1
bd007d13ce26ecbe430a4eb4e8c24c7236d833a9

SHA256
dfcc76f4748061cec60e289b1490df910728e1a0dd44fc9eb00572210e8a7737

SHA512
4662fa878f95c8663b2800b46d72e6590a7b1c57cf64a387e261e1b65a1d21ed99ad16268900829ddcc2b8b3dfba5aec843aeda1382a936c057666cf7fb5d669

Download Submit
C:\Program Files (x86)\JiSuZhuShou\x64\usbhigh.sys

Filesize
331KB

MD5
0c2ccb3287db8c0bca93569461b97e9f

SHA1
0c0ac0ddec5ecc8a065215310a1cd7da28ae3195

SHA256
7615f6b3c8ee53ed8d12fae8f1233bb09f9268fb8cda112fc417e4ca66266c78

SHA512
2baa8a69fe76d9e0fc91166587d0dc5ede1b608c663ccfd9fded9a5925a005d23967a3910a7606d360d304d95e4825527a707482d8387e8774f697ba998b020b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5845.tmp\JSZS.exe

Filesize
2.4MB

MD5
d15c35e491675bb98a7824dcf7cfa7e7

SHA1
77f1fd00b0d0a085353c3d83b0b5183aacc623ea

SHA256
4badfcba4996371c89d5871e5cc8311bce6cecf917627337f86b4f85178b6875

SHA512
7bf1ea3fbcab5296b28a7e8c60816a722685b2a04bf33b001c6fed584ad16963f7832f6de6d83449a6a9be6c37392e16c0bae09804aea0c408389179540333bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5845.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\qii57A5.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/3004-27-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/3004-26-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3004-29-0x0000000002380000-0x00000000023F3000-memory.dmp

Filesize
460KB

Download
memory/3004-25-0x0000000002380000-0x00000000023F3000-memory.dmp

Filesize
460KB

Download
memory/3624-56-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3624-66-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/3624-68-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4040-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4040-55-0x00000000020A0000-0x0000000002113000-memory.dmp

Filesize
460KB

Download
memory/4040-54-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4040-6-0x00000000020A0000-0x0000000002113000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing