Overview

overview

10

Static

static

1

json.js

windows7-x64

10

json.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    json.js

  • Size

    37KB

  • Sample

    231207-pmtxsaaf25

  • MD5

    893e89b36af438fb9a2ee7a64c99beb5

  • SHA1

    e42c2cac9da61ab8145940a9968cb86d73ff7a8e

  • SHA256

    26a9a3c1edc598593f6ae0674c496f05f26a93a75313deadd5c0fd8abf6fd00f

  • SHA512

    243b8d1b933ec1a9936fb84718304aa8596b150eb357ffe7aa4ff5b7662df1bbbc25fc662617951511a578ba03ff6fd0aae95d764f8278f353bddfa1ca333751

  • SSDEEP

    768:mbhFrFiVCizd/idudK1ul7sl/lzlxihnGPezl7sl/l0lEPjlc:mbhFrFmCY/OgK1GnQeWO

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://uploaddeimagens.com.br/images/004/683/196/original/dll_js.jpg?1701821835
exe.dropper

https://uploaddeimagens.com.br/images/004/683/196/original/dll_js.jpg?1701821835

Targets

    • Target

      json.js

    • Size

      37KB

    • MD5

      893e89b36af438fb9a2ee7a64c99beb5

    • SHA1

      e42c2cac9da61ab8145940a9968cb86d73ff7a8e

    • SHA256

      26a9a3c1edc598593f6ae0674c496f05f26a93a75313deadd5c0fd8abf6fd00f

    • SHA512

      243b8d1b933ec1a9936fb84718304aa8596b150eb357ffe7aa4ff5b7662df1bbbc25fc662617951511a578ba03ff6fd0aae95d764f8278f353bddfa1ca333751

    • SSDEEP

      768:mbhFrFiVCizd/idudK1ul7sl/lzlxihnGPezl7sl/l0lEPjlc:mbhFrFmCY/OgK1GnQeWO

    Score
    10/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks