Overview

overview

8

Static

static

1

89537e9aa3...0e9.js

windows7-x64

8

89537e9aa3...0e9.js

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    89537e9aa35273022114d54b14e02f1a8c7bcf80c172f87fcf981e9bbc00c0e9

  • Size

    26KB

  • Sample

    240516-s44ebsbe8t

  • MD5

    68683b33d78997e81c059e829b695ae9

  • SHA1

    53ca2d9a583993d81f6e991547759cd0b63fede0

  • SHA256

    89537e9aa35273022114d54b14e02f1a8c7bcf80c172f87fcf981e9bbc00c0e9

  • SHA512

    976ce3003000d87f0f8112d6fa4fc0a17f378a952f0a8d3eb81ab3c8a1c4b90f77a9e4fa51d48c772d132937568ce9004b1460781ae2e4c3a54a5223f86a10da

  • SSDEEP

    768:2HdJjSibJ43M3fSjDHTjBV+GOE2wJUAqghiI9yFFBPtKA2K/MOgmT1TZuPrguIbu:ojLJ4R73ZF/kq03Cvp/

Score
8/10
executionpersistence

Malware Config

Targets

    • Target

      89537e9aa35273022114d54b14e02f1a8c7bcf80c172f87fcf981e9bbc00c0e9

    • Size

      26KB

    • MD5

      68683b33d78997e81c059e829b695ae9

    • SHA1

      53ca2d9a583993d81f6e991547759cd0b63fede0

    • SHA256

      89537e9aa35273022114d54b14e02f1a8c7bcf80c172f87fcf981e9bbc00c0e9

    • SHA512

      976ce3003000d87f0f8112d6fa4fc0a17f378a952f0a8d3eb81ab3c8a1c4b90f77a9e4fa51d48c772d132937568ce9004b1460781ae2e4c3a54a5223f86a10da

    • SSDEEP

      768:2HdJjSibJ43M3fSjDHTjBV+GOE2wJUAqghiI9yFFBPtKA2K/MOgmT1TZuPrguIbu:ojLJ4R73ZF/kq03Cvp/

    Score
    8/10
    executionpersistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks