Analysis
- max time kernel
219s - max time network
247s - platform
windows10-1703_x64 - resource
win10-20220718-en - submitted
02/08/2022, 18:51
General
- Target Va_private_road_maintenance_agreement_form (qxwv).js
- Sample220802-xhw6cabcgr
Score
10/10
Malware Config
Signatures
- GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Blocklisted process makes network request 3 IoCs
- Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Va_private_road_maintenance_agreement_form (qxwv).js"1⤵
- Blocklisted process makes network request