Resubmissions

09/10/2024, 23:23

241009-3dblqs1cme 10

General

  • Target

    JJSploit_8.10.7_x64-setup.exe

  • Size

    5.7MB

  • Sample

    241009-3dblqs1cme

  • MD5

    87bece829aec9cd170070742f5cc2db7

  • SHA1

    0a5d48a24e730dec327f08dfe86f79cc7991563e

  • SHA256

    88a19d3e027158e8c66d5068303532a0d56a700f718db80aa97e5e44f39bf4a4

  • SHA512

    198c80d4b430a38ac597ff9023128cdbc9d2891097beef239721c330c75a412c0bdb87a4bfb0609db94f320655f3df1fab7d885843c0af40687e46ddcc88c9d1

  • SSDEEP

    98304:hrPwHVCta3WJ3eKrvOsbroYIknJ0a/eFuwsqQkHOkb5DSnum1YmDhnu5NHxHDb4I:hyMAzKrv5raUJ32kbTlSD16ACG7x

Score
10/10

Malware Config

Targets

    • Target

      JJSploit_8.10.7_x64-setup.exe

    • Size

      5.7MB

    • MD5

      87bece829aec9cd170070742f5cc2db7

    • SHA1

      0a5d48a24e730dec327f08dfe86f79cc7991563e

    • SHA256

      88a19d3e027158e8c66d5068303532a0d56a700f718db80aa97e5e44f39bf4a4

    • SHA512

      198c80d4b430a38ac597ff9023128cdbc9d2891097beef239721c330c75a412c0bdb87a4bfb0609db94f320655f3df1fab7d885843c0af40687e46ddcc88c9d1

    • SSDEEP

      98304:hrPwHVCta3WJ3eKrvOsbroYIknJ0a/eFuwsqQkHOkb5DSnum1YmDhnu5NHxHDb4I:hyMAzKrv5raUJ32kbTlSD16ACG7x

    Score
    10/10
    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      15KB

    • MD5

      ee68463fed225c5c98d800bdbd205598

    • SHA1

      306364af624de3028e2078c4d8c234fa497bd723

    • SHA256

      419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

    • SHA512

      b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

    • SSDEEP

      384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij

    Score
    3/10
    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      d070f3275df715bf3708beff2c6c307d

    • SHA1

      93d3725801e07303e9727c4369e19fd139e69023

    • SHA256

      42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

    • SHA512

      fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

    • SSDEEP

      96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    • Target

      $PLUGINSDIR/modern-wizard.bmp

    • Size

      25KB

    • MD5

      cbe40fd2b1ec96daedc65da172d90022

    • SHA1

      366c216220aa4329dff6c485fd0e9b0f4f0a7944

    • SHA256

      3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

    • SHA512

      62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

    • SSDEEP

      24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      6c3f8c94d0727894d706940a8a980543

    • SHA1

      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    • SHA256

      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    • SHA512

      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    • SSDEEP

      96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc

    Score
    3/10
    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      29KB

    • MD5

      8def0196223484f8aed4106148dd3f08

    • SHA1

      e0fc0951deb0e5e741df10328f95c7d6678ad3aa

    • SHA256

      c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333

    • SHA512

      9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7

    • SSDEEP

      768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q

    Score
    3/10
    • Target

      JJSploit.exe

    • Size

      10.5MB

    • MD5

      e59012474c711e0db071950d859bac42

    • SHA1

      2a1839c61829b70874aaecd41d76a03b8c6cb5dc

    • SHA256

      5bd65131cad50c58ae916818d54abe44c014854db770aa71a9933293939ad576

    • SHA512

      61e94c2949d9f08d2ce37dbe5687cc8ff68b274e2ee56d530870a977773a1e04ac58bca4f550887790f0d31534d862cdc869a90621c03ebf030cf73b41fd5774

    • SSDEEP

      98304:cmnvcwo6FMJAAqD+YJTmUmGs0ITIECta99bUHp1TdZiyAIxlh/H:xUHrdqeUGB9bU3dZH

    Score
    6/10
    • Network Share Discovery

      Attempt to gather information on host network.

    • Target

      db.json

    • Size

      311B

    • MD5

      84095feb496d351b9c80e926938f9ca8

    • SHA1

      d8ac99f45d8420698809521a4c1a30e954f118da

    • SHA256

      1ee333036765e94b9f6975a2cfb6a799c42b3357078b424753f6aa61b225e54b

    • SHA512

      347ef12c4f1849a5455014413097ea6d7a6406b36027da4734afad736a5581c6068dd4878aeab02843abbc1e1cfdb37f34c167b4886c8644ad8778e592393e10

    Score
    3/10
    • Target

      libcrypto-3-x64.dll

    • Size

      4.5MB

    • MD5

      a9c1f7ca15c65c139bc9d4bf57df2e1e

    • SHA1

      1b1377139a6b289d43a6b1161cd1089ffc817cf9

    • SHA256

      03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116

    • SHA512

      97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073

    • SSDEEP

      98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC

    Score
    1/10
    • Target

      resources/luascripts/animations/dab.lua

    • Size

      217B

    • MD5

      ee91641376e1217de57ad17ea74da5cb

    • SHA1

      7a90a78e985bb8b3d09d60dd0ac99d1dd9135ed5

    • SHA256

      efd5e7407c3fc69338237d3c9686596f78bb5fe3181ed10640efad5839f6112a

    • SHA512

      c538e8ed0c75da0863cdc18e76bfae63fe127b79dd052812d43ee17b8880d7f621ad5a10610ebce3ba4aa24931e720976cde714455c0e53c5c17d8daab90dc0f

    Score
    3/10
    • Target

      resources/luascripts/animations/energizegui.lua

    • Size

      54KB

    • MD5

      70b51c18fbf11b73271e552fbb224396

    • SHA1

      b9da409b40d79ad97669de22420a94d2f2e35b53

    • SHA256

      7e7579ac512265fc6508b7b4d025ee923bca7f23937ed10f41befdc440c28761

    • SHA512

      076eb96fba7d851b38a2422f78a2204bb62f25ccda23188cd3f0d501ecfeb41a7859653293833ff6fd0d9da232d83a1c67567fc295570598af450a9ef1fa2732

    • SSDEEP

      1536:0WewiYXHrrUtQ0y25+BTb/Z0YEbfL3eCKvzGOv1xj6UpTCs1hOuO:0WewiYXHrrUtQ0y25+BTb/Z0YEbfL3eY

    Score
    3/10
    • Target

      resources/luascripts/animations/jumpland.lua

    • Size

      217B

    • MD5

      2899ec217aef73b127c9328785012eef

    • SHA1

      445ee17a3f9d5912a7de0715b96e67dd606ce9e3

    • SHA256

      7d4ca7b02c90b0b21d64c2baa6e5940dcce895db5bc125d0e993a5a883186721

    • SHA512

      9a01d23442c0b1baba6ef6fef1c7498726958d67caa85728e0cc152800a4ed2259d0e5cd63509df397239714f5bb288552b31bee7fc49a60f69e05991eb6beb0

    Score
    3/10
    • Target

      resources/luascripts/animations/levitate.lua

    • Size

      217B

    • MD5

      d09da2b730602a59c3289b72e63137bb

    • SHA1

      a8793635ae9ceddac54d1e6e6d27eb4938c4446a

    • SHA256

      2af3980171cc17a4d7687b7489fe8b0bb193e5080c0ca76e5501983a0b3efadb

    • SHA512

      21c0dafdd0f6d7ce7fa57b38ffd5af13bb9dc228bb466372e60f5d7c645895faecb81a55342b8abac1669e8c9b412d2b278cfeb1da65380b8876f809928b1b22

    Score
    3/10
    • Target

      resources/luascripts/animations/walkthrough.lua

    • Size

      218B

    • MD5

      348e2fcfe114ef12e8db7ae75f24de15

    • SHA1

      97e1bca8ba3d1450db0af8d05fa741fe21a13e0f

    • SHA256

      10409b6d213db5683ec415fa1a8cde85b38fd057c9aa7b88c3fe4fbb19cd54b0

    • SHA512

      e545915d83d99f97b0e3cdf2353d877b5a4e91ec651d09cc8f659cb483fcecc4e14eb452140b3500a9fe34acaab4c733359a8d51f85d827f39ffff9b0b8ae9df

    Score
    3/10
    • Target

      resources/luascripts/beesim/autodig.lua

    • Size

      508B

    • MD5

      a99f423612e047906c288d32ded6f773

    • SHA1

      6c7274348ea70cfbe0250eadf69208aa976dda8d

    • SHA256

      afd46c7cd01f271454c96d9bc71ecd4778d508c23d5c66103a85b8ba180dbc8a

    • SHA512

      32a62f50983c7732ece800def1c3602f2cb19a9235cd2e46c07d67e2304c227e0c7f1c266fefe2a7995758457bb16f2b690d7c9688d8f8df8087a9f2942d5167

    Score
    3/10
    • Target

      resources/luascripts/general/chattroll.lua

    • Size

      254B

    • MD5

      e1b50885cba14899315b8bd4ea19a3da

    • SHA1

      950f46a1b60415cff079303253c8efb9ce03acb1

    • SHA256

      e319dbe0926ef8db1854e6481c5fa02ea71abdfe0a0cbef0656b4c441e0b22e8

    • SHA512

      233fad6f4aa4dffb01ca52ea8cf7fddbc01416a7038472d7f9e3dc7b5adff3ea141f8914c9146fb6e4395f6bf6b6a12c1191167b746258985b6ec5a6c7ffe9ef

    Score
    3/10
    • Target

      resources/luascripts/general/fly.lua

    • Size

      3KB

    • MD5

      54a3c002b2b1e311b6488b5796094457

    • SHA1

      c296ead09417811e10ce6fb59a59b00ce838988f

    • SHA256

      4f4098a0ccad434e7cf4684df559858bddd5d17768f4c8bf89b0bed072575a47

    • SHA512

      f421853a16b616887fbb98752b3be64568e3833db40c5b1cbe262e52c820d84b523170229fdbe7fcc12a59cd09f52ed9ff2ce66775a43a8ada9f5408b9323f28

    Score
    3/10
    • Target

      resources/luascripts/general/god.lua

    • Size

      528B

    • MD5

      121a9ce65d07175515c986d40502f1a5

    • SHA1

      c53849d143f6f44882992ba626b82b2cd9cf2259

    • SHA256

      dbfbb0b80576aa03c66ca23d4510c5b5eb33fca8ab2031be75556073230de323

    • SHA512

      e2c57c1ea38da22c61f452695841529d2048b5b8a9277f1df9f5c3474a31017195b66a3d2f473fb9d5c8b905c39efaf036dab397cee6bd581cf1861277068f40

    Score
    3/10
    • Target

      resources/luascripts/general/infinitejump.lua

    • Size

      1KB

    • MD5

      f13b9ad3f7d7eb0827d189699d50490c

    • SHA1

      55f4e2fc1ea9ab6ceacd7789c8fe27e08eb64e39

    • SHA256

      e81510eb4ee69a72d9087defd412453c0c63d2772cac3749757b842fb126e435

    • SHA512

      f662f5ff734a1f0c35509942de47bc55a33509d2d72ab1d70e07120aef4569d9caac54611f05261066de7a11e1804116ec54acfa107ec00140df095929f04caf

    Score
    3/10
    • Target

      resources/luascripts/general/magnetizeto.lua

    • Size

      547B

    • MD5

      befd3490dad3a1f6dbd3dbd9092642d4

    • SHA1

      20a315d7213fe85d7318756938d71ae7c873989f

    • SHA256

      0be4ddf7198a0e7de42be0e2869039b664c71256d52242f8c25f067e58c2c558

    • SHA512

      6c6e8c9dad78fc77bbb0c8c267febb088d48e0dad5775c0288218ec003bbaff3cfae711adb39a0708075f90aef0c21450d01c02b6bd73972282d397eeb1052f5

    Score
    3/10
    • Target

      resources/luascripts/general/multidimensionalcharacter.lua

    • Size

      470B

    • MD5

      09db01f6c4391cb577de8884a2aa43d0

    • SHA1

      bf1e3fa24af0a359f1d9f6c5fb63c555a88b5f3c

    • SHA256

      fecd01eeb5fa869bbeb9eb53e585e6ebcbc8ab658d6d7628dcf734bcf65d8135

    • SHA512

      ca9e9efd2742985cdae48c60e98ee7f19f34819d60c16aa5cb4c893c01eb70e1e0168fb0e533d74ecf7c850edf6a536f0045d563afde82af148bf222f42b2e98

    Score
    3/10
    • Target

      resources/luascripts/general/noclip.lua

    • Size

      1KB

    • MD5

      d6a6ee15ae62c9922ebfa6db81263288

    • SHA1

      0e3526210d72a9a4da4591095ad797933a02b7a3

    • SHA256

      9f4efc279d94977f92bd52165dfda141a43aff9149e044ed44742f7ef39cfe4f

    • SHA512

      c1faea983c3b6bd7372195a65184c2a93d9703dff06aebbe62d05c731866cb325f85afa915334e5f49f1bdf38fe91e3df86c7eb0913a215b6b1764fb3d2b17bf

    Score
    3/10
    • Target

      resources/luascripts/general/teleportto.lua

    • Size

      170B

    • MD5

      cd719ca0e57c68facfacef67c2aafe90

    • SHA1

      14a7b929d49c7c2d446fbe1b3e2c9365810ba419

    • SHA256

      a22a6ef7a55035961c0a6f529c77d1100a333ec7a4caa6384962e273c76cba33

    • SHA512

      280f3f9ca3900a46817ccc2949e95ac380dfcda7652e8ed79a8087e823de7953bc7b6b6a42ba531a98abee5d5bccb87e43c25b588de15ea420a5c821a824256c

    Score
    3/10
    • Target

      resources/luascripts/general/tptool.lua

    • Size

      446B

    • MD5

      78990037f24311727092f08334ace6e0

    • SHA1

      3397c4eb0147c39aea746193ffa534e92a586bb3

    • SHA256

      17bdad5a7e4910982519f219b1e40525f4f5b2e4c55224e491a13ce4d98ca60c

    • SHA512

      135c2e6e64557a48da0ca0e01b419aa9e8cd1b67f370cc2e9905aa33d785c773745fdcd28fdb5db5edcea60f62c5560c233b8630184ab98cfa5f99931249311b

    Score
    3/10
    • Target

      resources/luascripts/jailbreak/criminalesp.lua

    • Size

      429B

    • MD5

      eca04338c0a816002856b788faac0a47

    • SHA1

      1183f781b7bb2514f2a2af666813edf0f81eb3a5

    • SHA256

      354cbf71ea3d2581fc192c896efab1c5555dcecfdca6982a84f319e7c7b252da

    • SHA512

      9161795552164144f233b6678263b64739e2e25bfd10f10d342efb1875666e08871610e2d4a58d29e64b931cf8f83553395bef1acf76d20da77c8b0db5f30fc2

    Score
    3/10
    • Target

      resources/luascripts/jailbreak/policeesp.lua

    • Size

      436B

    • MD5

      4f50ffcd1d3b9ae16550950cb634ba92

    • SHA1

      7eff02b030b8980452b56bf952f06ec0f3d182e6

    • SHA256

      2beb5cdc4fa2f8b7fbfe8f29db19e0fbca7a00d91835ab5257d84f2b042babef

    • SHA512

      89bed07e5e39f5495dd05adc54f9395de0144bdfd4caea1a1b0850dadb1d32c880c9d415259f7eebbc1ce64130a26da92aed75906a45669286ae8687aef3b454

    Score
    3/10
    • Target

      resources/luascripts/jailbreak/removewalls.lua

    • Size

      403B

    • MD5

      00bc897c4bcbdf5660c3b1f703602f0b

    • SHA1

      fb3cfe70ad821950b758c31bffe2bd2f8f2e6128

    • SHA256

      a477ffe6d4c769e2e859417af43ed4e21107e174df8274bc9487963659462f31

    • SHA512

      68e919d2386a4ad8d2d2c1d37023dd50eb633528ae110c9598b72f26fcdebecc89462e72617a491310f4830da4a85889cf2cef1789fb783619e3d309b623fb4f

    Score
    3/10
    • Target

      resources/luascripts/jailbreak/walkspeed.lua

    • Size

      212B

    • MD5

      76d6bc545a92d108ff8a18614a5db4ad

    • SHA1

      f303007795fb60c9b63cfb33c92ac6083fc3fc56

    • SHA256

      a7931ee89662c563637e1752228923d182f42f3a70286d4fd0a1fff993c9766d

    • SHA512

      e4a01e1959de1345f137dd7659c3b70e816ccbdd92fa2662eb1695bf3e829dd9de8bb16736445a1f39e20384a2c91c9c6fd547352827d52fab320ba8cecff3f3

    Score
    3/10
    • Target

      uninstall.exe

    • Size

      74KB

    • MD5

      fcbc4b016ca7164b57d332d4012f3b85

    • SHA1

      b1f8ca1824216100edba1bf52c4a953335e277fd

    • SHA256

      11a861694c2a3cce1e14020ffd46aef7dbcee861763203c5aebe8f4fa1cfba3b

    • SHA512

      5b5569ab94108f535345d6b71c105222daebbe34d2132ff1f03df84151c3b7488f0f6cda7bb054694bbc58234e709a6069bfdd9239076395b4a823f2d8848b3a

    • SSDEEP

      1536:XmsAYBdTU9fEAIS2PEtuugdLeAyNxbKPVe9IrSJuMtO01qb:WfY/TU9fE9PEtuuceACc6gCAb

    Score
    7/10
    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Target

      xxhash.dll

    • Size

      46KB

    • MD5

      249a5f6ca047df2a2f802782696c7f80

    • SHA1

      6a1d96be0f497d689fb55de70284af83cac61f52

    • SHA256

      2828e3014c3283caeb1b00d14145a42f4e347e7f547b40634540394892265671

    • SHA512

      d2d0b6ba2ec95c33609d98788e5a4cce382d93721ea5dea61cde3f4c065b06530a0b01ae4909f7883a81d55529a36cb6a5820aa2afc320b5761f6f59a3a45f1f

    • SSDEEP

      768:zziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3QimeSyygGz1K:zziR74kgDn2rDRuIrN5mAvgbTgi3SylI

    Score
    1/10
    • Target

      zstd.dll

    • Size

      638KB

    • MD5

      21dfe873f6ed38f2f713ecd43ad1ba41

    • SHA1

      7648cb043587da0e85743f9da8dca8be621ccdf0

    • SHA256

      2a2d63c48b6b3ac7768231ade30122c94a0a33e62e5d2725e11c95b3194aa997

    • SHA512

      67b4f976f3511387ce2a4743e2281ac88533bd204d4e07a5c6751f0ec30a3463dfabcda18103a632541ec2a8b7b937806121e21e44959411c39106e22b739919

    • SSDEEP

      6144:XbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4eTTzp:XbauYGT5BYMxjDHMk0petRCEyb9emHW

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
10/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
6/10

behavioral9

Score
3/10

behavioral10

Score
1/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

execution
Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

discovery
Score
7/10

behavioral31

Score
1/10

behavioral32

Score
1/10