Analysis

  • max time kernel
    140s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    18-08-2024 17:21

General

  • Target

    jpdesk.exe

  • Size

    903KB

  • MD5

    fd11f6fe68c6a543576fd06e9258b359

  • SHA1

    df92e8b8f6e1e16f00667387f249c1f6b9cc8892

  • SHA256

    a5e2d6c7db54bc2e15ff5b7bd0f0bf4c416b842fdd2a609e5d85b67b9650c686

  • SHA512

    4480373c91cc23174c08852cdbabbb0cca10b938c9c1ae73dae775bf83dd8977f65fc54955fe593dc32bede246002c310d32bad33a21c183c212ff0092ff6c2d

  • SSDEEP

    24576:+oAXT+u1Ngb1FPQgfqIRknfKtefSTpME2ZRh4r:+H6uWMmqfSTGEmL4r

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\jpdesk.exe
    "C:\Users\Admin\AppData\Local\Temp\jpdesk.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\jpdesk\CurTheme.Theme

    Filesize

    976B

    MD5

    ba2a4bd9af2ba0e0324301a6a835dc75

    SHA1

    6becfd2adf1a151ce25fa747c65658de763fd850

    SHA256

    c3e287caa02d75af03a8d7049f868d72611e5fbfc25dbe813d26f2392a479718

    SHA512

    12d61c5aaafec928a1dcb586ae05784d4f359ed54379fbb1ad65c47fd5580eda3629029a7574b30e536576cf0cd16308c8f0ace72294a976abc942d4bf4d7284

  • C:\Users\Admin\AppData\Roaming\jpdesk\DefSoft.ini

    Filesize

    2KB

    MD5

    09c7ca120d653513cff0e68bd1cfe44f

    SHA1

    852a166c1ff59ecf74a7ebd24a43bd5b2f9835d7

    SHA256

    63f92cdceaaad357263ee065baf511b60f5ec80caa9d34404162be3503953b4f

    SHA512

    7f0c64d483f27bd176b9f47ce659ff19ceb1c53e79cbd55b0f2aa83c8634e8f2ed05c2f903d78e7049d92aeb419f8a5f47c5e1fe5c8e08adfed103ff299447db

  • memory/2532-391-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-394-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-386-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-388-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2532-387-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-389-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-390-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-0-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-392-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-1-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2532-395-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-396-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-397-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-398-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-399-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-400-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-401-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2532-402-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB