Overview
overview
5Static
static
3JJS-UI/LIC...m.html
windows11-21h2-x64
5JJS-UI/res...le.dll
windows11-21h2-x64
3JJS-UI/res...bot.js
windows11-21h2-x64
3JJS-UI/res...48c.js
windows11-21h2-x64
3JJS-UI/res...oad.js
windows11-21h2-x64
3JJS-UI/res...ker.js
windows11-21h2-x64
3JJS-UI/res...ngs.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...js.ps1
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...unk.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...eam.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...til.js
windows11-21h2-x64
3JJS-UI/res...ash.js
windows11-21h2-x64
3JJS-UI/res...ser.js
windows11-21h2-x64
3JJS-UI/res...mon.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3JJS-UI/res...dex.js
windows11-21h2-x64
3Analysis
-
max time kernel
430s -
max time network
1156s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/08/2024, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
JJS-UI/LICENSES.chromium.html
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
JJS-UI/resources/app.asar/build/JJSploitModule.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
JJS-UI/resources/app.asar/build/luascripts/general/aimbot.js
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
JJS-UI/resources/app.asar/build/precache-manifest.8d062de63087e77d0dfde937d2ab548c.js
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
JJS-UI/resources/app.asar/build/preload.js
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
JJS-UI/resources/app.asar/build/service-worker.js
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
JJS-UI/resources/app.asar/build/settings.js
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
JJS-UI/resources/app.asar/build/static/js/0.5b03d618.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
JJS-UI/resources/app.asar/build/static/js/0.5b03d618.chunk.js.ps1
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
JJS-UI/resources/app.asar/build/static/js/1.7c33c0ba.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
JJS-UI/resources/app.asar/build/static/js/10.49680587.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
JJS-UI/resources/app.asar/build/static/js/11.40047561.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
JJS-UI/resources/app.asar/build/static/js/12.b774e9f3.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
JJS-UI/resources/app.asar/build/static/js/13.b038224c.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
JJS-UI/resources/app.asar/build/static/js/14.50781f2d.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
JJS-UI/resources/app.asar/build/static/js/15.dbd09330.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
JJS-UI/resources/app.asar/build/static/js/79.c2c19858.chunk.js
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
JJS-UI/resources/app.asar/node_modules/cacheable-request/src/index.js
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
JJS-UI/resources/app.asar/node_modules/caseless/index.js
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
JJS-UI/resources/app.asar/node_modules/caw/index.js
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
JJS-UI/resources/app.asar/node_modules/clone-response/src/index.js
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
JJS-UI/resources/app.asar/node_modules/combined-stream/lib/combined_stream.js
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
JJS-UI/resources/app.asar/node_modules/commander/index.js
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
JJS-UI/resources/app.asar/node_modules/config-chain/index.js
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
JJS-UI/resources/app.asar/node_modules/content-disposition/index.js
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
JJS-UI/resources/app.asar/node_modules/core-util-is/lib/util.js
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
JJS-UI/resources/app.asar/node_modules/dashdash/lib/dashdash.js
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
JJS-UI/resources/app.asar/node_modules/debug/src/browser.js
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
JJS-UI/resources/app.asar/node_modules/debug/src/common.js
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
JJS-UI/resources/app.asar/node_modules/debug/src/index.js
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
JJS-UI/resources/app.asar/node_modules/decompress-tar/index.js
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
JJS-UI/resources/app.asar/node_modules/decompress-tar/node_modules/file-type/index.js
Resource
win11-20240802-en
General
-
Target
JJS-UI/resources/app.asar/build/JJSploitModule.dll
-
Size
117KB
-
MD5
80b6d5f12dfe42f21dc5ec5ee793ad08
-
SHA1
53aca73b99b75191bdce2a025151848b370dfeae
-
SHA256
0d7f23c4e4b1a3dd6e2e77465b4bbe1487a82e9681c327e48090abf3c726ec0f
-
SHA512
236fa76c080f915f221d0584445261b87c77425400f260555395f0f5a29ca3cffb6ee8c9e477d1d4895c10406e651c8d87771f1b1de889fca5bd6bc4f818bc9d
-
SSDEEP
3072:ObUR7NwgCAgXytiN3cG5AsiGEcDcaAyp/kfH8lh9rrR:xpmBAKytOM6AsgcDcMJP3R
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 888 2940 WerFault.exe 80 1564 2940 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4564 wrote to memory of 2940 4564 rundll32.exe 80 PID 4564 wrote to memory of 2940 4564 rundll32.exe 80 PID 4564 wrote to memory of 2940 4564 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JJS-UI\resources\app.asar\build\JJSploitModule.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JJS-UI\resources\app.asar\build\JJSploitModule.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 4643⤵
- Program crash
PID:888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 5003⤵
- Program crash
PID:1564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2940 -ip 29401⤵PID:1036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2940 -ip 29401⤵PID:424