General
-
Target
JJSploit_8.10.12_x64_en-US (1).msi
-
Size
5.0MB
-
Sample
241110-wl6nhs1hrm
-
MD5
0c51311b8e9d06dc32930c38c98a7b95
-
SHA1
aacbb77423f97d4bc7ec74c75dc6807ed4338623
-
SHA256
26323b34dc2f151859ba9d36615463908478a70915bc7076a1babe52855c22c0
-
SHA512
aa3f4baaeab39e29d7b16221871d6a1219310b43d750415dbd7b114c57b1c133bbfc25e213398ace80cf361a4f6389c191cba56713985a5ce238d920610c0801
-
SSDEEP
98304:pmWSrgVIcbfrkMbdLm2K5AEwFY7V9d+uEgPfju0M6eMNEH5rSbZw6Wv8m:pycbf5bxU1d+uTPfy0M63NQ5r
Static task
static1
Behavioral task
behavioral1
Sample
JJSploit_8.10.12_x64_en-US (1).msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JJSploit_8.10.12_x64_en-US (1).msi
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JJSploit_8.10.12_x64_en-US (1).msi
-
Size
5.0MB
-
MD5
0c51311b8e9d06dc32930c38c98a7b95
-
SHA1
aacbb77423f97d4bc7ec74c75dc6807ed4338623
-
SHA256
26323b34dc2f151859ba9d36615463908478a70915bc7076a1babe52855c22c0
-
SHA512
aa3f4baaeab39e29d7b16221871d6a1219310b43d750415dbd7b114c57b1c133bbfc25e213398ace80cf361a4f6389c191cba56713985a5ce238d920610c0801
-
SSDEEP
98304:pmWSrgVIcbfrkMbdLm2K5AEwFY7V9d+uEgPfju0M6eMNEH5rSbZw6Wv8m:pycbf5bxU1d+uTPfy0M63NQ5r
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Image File Execution Options Injection
-
Legitimate hosting services abused for malware hosting/C2
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1