a5df55c2faae4173f0ac10f8efc5e95e47dabf3b922c67c885bae790c67bcf44

General

Target

2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe
Size

6.3MB
MD5

2cb9403b9fff02fbd2c225e77a9ebefc
SHA1

592b6b689717fe3910dbeae442e8cebcc2d11d9f
SHA256

a5df55c2faae4173f0ac10f8efc5e95e47dabf3b922c67c885bae790c67bcf44
SHA512

15f8d3e9beddf1925e1460494cf8270986c6de78e90dd4670deabc5bfb01380babbe464d949ee1308c293df309f9a6e4f0e5ace4979340d394707f08678626c4
SSDEEP

98304:PmrB1wH//ThJIOsD9hmIaFoAHEBN7CbdlB5lA8ICrBdzkxZKzq2vN7BEy3Xp:POAH/tmOs8KObnr3W6q2l7BjJ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
372	UUSEE_niuniu_Setup_152.exe

Loads dropped DLL 9 IoCs

pid	Process
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe
372	UUSEE_niuniu_Setup_152.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nsis_loader.dll	UUSEE_niuniu_Setup_152.exe
File opened for modification	C:\Windows\SysWOW64\nsis_loader.dll	UUSEE_niuniu_Setup_152.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UUSEE_niuniu_Setup_152.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023c79-6.dat	nsis_installer_1

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3188	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe
1832	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1832	3188	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe	84
PID 3188 wrote to memory of 1832	3188	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe	84
PID 3188 wrote to memory of 1832	3188	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe	84
PID 1832 wrote to memory of 372	1832	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe	86
PID 1832 wrote to memory of 372	1832	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe	86
PID 1832 wrote to memory of 372	1832	2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2cb9403b9fff02fbd2c225e77a9ebefc_JaffaCakes118.exe" /SETUP
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Users\Admin\AppData\Local\Temp\UUSEE_niuniu_Setup_152.exe
    "C:\Users\Admin\AppData\Local\Temp\UUSEE_niuniu_Setup_152.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UUSEE_niuniu_Setup_152.exe

Filesize
6.2MB

MD5
be07aaba4b10e95d4f1616b6b5aede47

SHA1
79447b85fa53f27bc08e4a002da6ca9bd90aa0ba

SHA256
58a65388951fd9b3868911bcd55c7e52f926ebde26103c667fee8594e1617ae2

SHA512
27e2dfdd1f45c1660cd6da7b0a0d1c459d2dfbd9d5a37c5a2b40b67e3525db38475bb38ce5b01c635931148e4925e3a143925c12e23d54aa895a4e5e1bd454b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj9C70.tmp\Banner.dll

Filesize
4KB

MD5
cfd098f51274f23e903d58ca08c2d763

SHA1
e3ee66f1087199cb4f03be3b8754ad84519d2c67

SHA256
ef1b2a0d78fa2c0ea8bbf3ce30336c3c582d19cb33447a5918666c0b5d1a53fa

SHA512
3fdf7d52ebe0ee6df98712f07ebb93c7098032422a1d4bf4e1ed17abf0b258c1897841416f36d8b6ae3ecc8a0f8d81920c6e5537c64ab2e00a5e7950037411c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj9C70.tmp\InstallOptions.dll

Filesize
12KB

MD5
3c19f79ce11facc2fc4d3351dbb263e0

SHA1
17f4bf4b18ea7700f70ac7d825dc997be0d25f71

SHA256
cfaba712ad640ce2b4890005ffcf03ed9e2a18a6cf9075295f3aaea1478896b9

SHA512
05c9ac861e4fed610171fcb5fad40abc30cbf90e9c7cb13c758f52cdff568af0fdd6af968db4fb143a748c77f21c353c7cffea28cbcbd2ad17157038ab490273

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj9C70.tmp\System.dll

Filesize
10KB

MD5
725145e8caa39635cab9899c47c72eda

SHA1
30478c907551bd920bf359638b091fc5c10b5a53

SHA256
1759e4f7777fb8c9ed356a7d4dc237a90e0760061685d44ea02d40ca9e359ceb

SHA512
de31286ea10321f762a3b6e7c6c82177d5b6f45a82adc936fcbbc23105708cbbbec903ba94ba94e7723e80f1828393e5395ef575b37136b19de7535e74e24547

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj9C70.tmp\ioSpecial.ini

Filesize
621B

MD5
02c75843f1b71ce3927a63953ce6f859

SHA1
755addbb5c84ef1945de27cb83d0f6e35ce38222

SHA256
e96171a59accbc0b8605b03db83a1544449dfa387fbbb1934d67e2a54bfea705

SHA512
31d490b14681e765d8457bc37a3be89f6f59f75b5c4c617950460e4b698fd8ec6eeeebcfffde56c28def2db0ec41a52ea44d541787d123528fa117f551ba735b

Download Submit
C:\Windows\SysWOW64\nsis_loader.dll

Filesize
24KB

MD5
cb004c514f4db290a92d0f072f6dc408

SHA1
49a52aac91ca5b10290872f80fcc8cca114fa6be

SHA256
ad0117c20a01ac779f664f2edfd7da0b8c77623e5301468c99ef6510db920a6f

SHA512
8d768433521eea54d3d7e274b8760f21e72c87881376299b987236bd95e7797814f71d23b2acae4b0a6d06a74b64093c993e2c3065374ed0bc678a0585cd9d98

Download Submit

Analysis

Sharing