Overview
overview
7Static
static
3Java反编...up.exe
windows7-x64
3Java反编...up.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDIR/nsWeb.dll
windows7-x64
3$PLUGINSDIR/nsWeb.dll
windows10-2004-x64
3$TEMP/fzhjd/1.exe
windows7-x64
7$TEMP/fzhjd/1.exe
windows10-2004-x64
7$TEMP/fzhjd/qqbq.exe
windows7-x64
7$TEMP/fzhjd/qqbq.exe
windows10-2004-x64
7Configuration.exe
windows7-x64
3Configuration.exe
windows10-2004-x64
3JDecompiler.exe
windows7-x64
3JDecompiler.exe
windows10-2004-x64
3jad.exe
windows7-x64
3jad.exe
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7�...��.url
windows7-x64
1�...��.url
windows10-2004-x64
1.rtf
windows7-x64
4.rtf
windows10-2004-x64
1Analysis
-
max time kernel
131s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
Java反编译 软件/JSetup.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Java反编译 软件/JSetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsWeb.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsWeb.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$TEMP/fzhjd/1.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$TEMP/fzhjd/1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$TEMP/fzhjd/qqbq.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$TEMP/fzhjd/qqbq.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Configuration.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Configuration.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
JDecompiler.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
JDecompiler.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
jad.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
jad.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
uninst.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
uninst.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
.url
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
.rtf
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
.rtf
Resource
win10v2004-20240802-en
General
-
Target
Java反编译 软件/JSetup.exe
-
Size
534KB
-
MD5
55004c58f2a56ffc87fb622ced8c2a0b
-
SHA1
0cf880da57ae67a7ba6b0fa00a626e5a6f19a71c
-
SHA256
f1b344c75b8385bcf5b884434de7b3d7f4e5b4526cf62727b5fee8e9cbe2bf7c
-
SHA512
edff7ce4aa576ca709c430bf455bfafde0b1275931a5aa961e8750eec84c8f817bda4254d221816cea399768765c780a9994bfa6143b2067426c98be321249cd
-
SSDEEP
12288:AdnRdg61QMGojHcLnHJX6lkrplz+MolBkSr:8nz5Q9oDqIEK1liSr
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Java反编译 软件\JSetup.exe"C:\Users\Admin\AppData\Local\Temp\Java反编译 软件\JSetup.exe"1⤵
- System Location Discovery: System Language Discovery
PID:408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3808,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:81⤵PID:2932