Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-09-2022 13:02

General

  • Target

    Letter_of_mutual_agreement_for_termination (dodz).js

  • Size

    483KB

  • MD5

    179e2ba18a5043cdcf2667d076bd3479

  • SHA1

    a3e680191910d5722da9b8fce52e110408a19b0a

  • SHA256

    76bce364872ba802a5bffb4f4a2145b66364fe1b8646aa7d76dfc2e5ef703d49

  • SHA512

    b20150ad2dc1e65ae1ac8c6d93b6de6eff8103743e9f6f3cb50d2897939f9e9ee7f094327c804f5cb6279f397f187fca9f2724b6d2b6342759214602cade1dde

  • SSDEEP

    6144:8mVQh2Xe2ulaxl4khEfD3IA7jiagmd4iLAmWh6lSF:83qhEfD3Iyiagmd4iLAmWh6i

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 3 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Letter_of_mutual_agreement_for_termination (dodz).js"
    1⤵
    • Blocklisted process makes network request
    PID:4712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads