Overview
overview
7Static
static
7a78a5562d0...18.exe
windows7-x64
7a78a5562d0...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...sk.dll
windows7-x64
3$PLUGINSDI...sk.dll
windows10-2004-x64
3$TEMP/UpdateInfo.exe
windows7-x64
$TEMP/UpdateInfo.exe
windows10-2004-x64
Update/jpborder.exe
windows7-x64
7Update/jpborder.exe
windows10-2004-x64
7jpdesk.exe
windows7-x64
7jpdesk.exe
windows10-2004-x64
7Analysis
-
max time kernel
140s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 17:21
Behavioral task
behavioral1
Sample
a78a5562d0369294194eae3df3159d1f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a78a5562d0369294194eae3df3159d1f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsWebJPDesk.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsWebJPDesk.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$TEMP/UpdateInfo.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$TEMP/UpdateInfo.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Update/jpborder.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Update/jpborder.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
jpdesk.exe
Resource
win7-20240729-en
General
-
Target
jpdesk.exe
-
Size
903KB
-
MD5
fd11f6fe68c6a543576fd06e9258b359
-
SHA1
df92e8b8f6e1e16f00667387f249c1f6b9cc8892
-
SHA256
a5e2d6c7db54bc2e15ff5b7bd0f0bf4c416b842fdd2a609e5d85b67b9650c686
-
SHA512
4480373c91cc23174c08852cdbabbb0cca10b938c9c1ae73dae775bf83dd8977f65fc54955fe593dc32bede246002c310d32bad33a21c183c212ff0092ff6c2d
-
SSDEEP
24576:+oAXT+u1Ngb1FPQgfqIRknfKtefSTpME2ZRh4r:+H6uWMmqfSTGEmL4r
Malware Config
Signatures
-
resource yara_rule behavioral15/memory/2532-0-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-386-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-387-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-389-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-390-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-391-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-392-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-394-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-395-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-396-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-397-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-398-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-399-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-400-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-401-0x0000000000400000-0x000000000071D000-memory.dmp upx behavioral15/memory/2532-402-0x0000000000400000-0x000000000071D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\极品桌面 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jpdesk.exe" jpdesk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdesk.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
976B
MD5ba2a4bd9af2ba0e0324301a6a835dc75
SHA16becfd2adf1a151ce25fa747c65658de763fd850
SHA256c3e287caa02d75af03a8d7049f868d72611e5fbfc25dbe813d26f2392a479718
SHA51212d61c5aaafec928a1dcb586ae05784d4f359ed54379fbb1ad65c47fd5580eda3629029a7574b30e536576cf0cd16308c8f0ace72294a976abc942d4bf4d7284
-
Filesize
2KB
MD509c7ca120d653513cff0e68bd1cfe44f
SHA1852a166c1ff59ecf74a7ebd24a43bd5b2f9835d7
SHA25663f92cdceaaad357263ee065baf511b60f5ec80caa9d34404162be3503953b4f
SHA5127f0c64d483f27bd176b9f47ce659ff19ceb1c53e79cbd55b0f2aa83c8634e8f2ed05c2f903d78e7049d92aeb419f8a5f47c5e1fe5c8e08adfed103ff299447db