Overview
overview
8Static
static
3JJSploit_7...up.exe
windows7-x64
8JJSploit_7...up.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3JJSploit.exe
windows7-x64
1JJSploit.exe
windows10-2004-x64
3resources/...ab.lua
windows7-x64
3resources/...ab.lua
windows10-2004-x64
3resources/...ui.lua
windows7-x64
3resources/...ui.lua
windows10-2004-x64
3resources/...nd.lua
windows7-x64
3resources/...nd.lua
windows10-2004-x64
3resources/...te.lua
windows7-x64
3resources/...te.lua
windows10-2004-x64
3resources/...gh.lua
windows7-x64
3resources/...gh.lua
windows10-2004-x64
3resources/...ig.lua
windows7-x64
3resources/...ig.lua
windows10-2004-x64
3resources/...bot.js
windows7-x64
3resources/...bot.js
windows10-2004-x64
3resources/...ll.lua
windows7-x64
3resources/...ll.lua
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
JJSploit_7.4.1_x86-setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
JJSploit_7.4.1_x86-setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
JJSploit.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
JJSploit.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
resources/luascripts/animations/dab.lua
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
resources/luascripts/animations/dab.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
resources/luascripts/animations/energizegui.lua
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
resources/luascripts/animations/energizegui.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
resources/luascripts/animations/jumpland.lua
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
resources/luascripts/animations/jumpland.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
resources/luascripts/animations/levitate.lua
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
resources/luascripts/animations/levitate.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
resources/luascripts/animations/walkthrough.lua
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
resources/luascripts/animations/walkthrough.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
resources/luascripts/beesim/autodig.lua
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
resources/luascripts/beesim/autodig.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
resources/luascripts/general/aimbot.js
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
resources/luascripts/general/aimbot.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
resources/luascripts/general/chattroll.lua
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
resources/luascripts/general/chattroll.lua
Resource
win10v2004-20240802-en
General
-
Target
resources/luascripts/animations/energizegui.lua
-
Size
53KB
-
MD5
ed3dfb140afc2dd6d0e743e98afdfcdf
-
SHA1
5b109156e02b2b9cfd1cb0adf01acbbc07e73c76
-
SHA256
0529358b29f4f6e153742cb96123bcd7e6e1ea4e865ea0aa9bbe0fec0c5d0152
-
SHA512
5264c1c219be4c88fd36db24cb7efdd5753e4a1f440447fd03be636e732826690e61bb5bb1d12c1642628d99ea136733a37096cb4b452bd32b3985aa18797eb5
-
SSDEEP
1536:uq2YCOZhtJW/C0myh01rjdDiqg8JkhX3nRIWyxWWXPGNp3ML9q:uq2YCOZhtJW/C0myh01rjdDiqg8JkhXd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.lua rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.lua\ = "lua_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\lua_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2464 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2464 AcroRd32.exe 2464 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2804 1820 cmd.exe 30 PID 1820 wrote to memory of 2804 1820 cmd.exe 30 PID 1820 wrote to memory of 2804 1820 cmd.exe 30 PID 2804 wrote to memory of 2464 2804 rundll32.exe 31 PID 2804 wrote to memory of 2464 2804 rundll32.exe 31 PID 2804 wrote to memory of 2464 2804 rundll32.exe 31 PID 2804 wrote to memory of 2464 2804 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\energizegui.lua1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\energizegui.lua2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\resources\luascripts\animations\energizegui.lua"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5275b1488956735dfd2ca46a6c919b0b1
SHA1ecc067698a23af1a962f683d99fd5a567323c16d
SHA256b45bde478f7da3fb1159e5d695663e5d89370b4c2987052607cac95c5881425f
SHA512bf334c4709939e49fcc69b1e5f9a768c580f4ad4ff469b99a0192a27070469c9c2a09331c7d8248f2b0fee4a586140da72aeea92bfbc077e659f028e8cf4ae39