Resubmissions

07-09-2022 02:42

220907-c685laahe3 10

07-09-2022 02:32

220907-c1fabsahd3 10

Analysis

  • max time kernel
    415s
  • max time network
    405s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-09-2022 02:32

General

  • Target

    Bws_agreement_2020 (cff).js

  • Size

    483KB

  • MD5

    1eb0afac12c4bae3a3fd238dd38feddc

  • SHA1

    135b3e89fd114fc590655df6a575800416afe379

  • SHA256

    5f6a9c6f3d8e243fce0af61ba82d82ce081020906b9b07490ea4988e1a0d7a8b

  • SHA512

    c6958530bdc1d74516bcd1a78688cc9ff358178f0a625e783dcb9dfaeb7a5c216c0255c2a18227a75eb00a9d906fe5a4a7f6ee474732734bcf48b639d8b8275d

  • SSDEEP

    6144:GQBXSEulaxl4khEfD3NA7Wiagmd4iLAmWh6CSF:kwhEfD3Nviagmd4iLAmWh6f

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Bws_agreement_2020 (cff).js"
    1⤵
    • Blocklisted process makes network request
    PID:2804
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4460
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        PID:4732
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 496 500 696 8192 688
        2⤵
        • Modifies data under HKEY_USERS
        PID:4208
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2260
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 496 500 696 8192 688
        2⤵
          PID:2196
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4272

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1908-115-0x0000023DD3850000-0x0000023DD3860000-memory.dmp

        Filesize

        64KB

      • memory/1908-116-0x0000023DD3A00000-0x0000023DD3A10000-memory.dmp

        Filesize

        64KB

      • memory/1908-117-0x0000023DD5EB0000-0x0000023DD5EB8000-memory.dmp

        Filesize

        32KB

      • memory/2196-347-0x0000000000000000-mapping.dmp

      • memory/2260-346-0x0000000000000000-mapping.dmp

      • memory/4208-119-0x0000000000000000-mapping.dmp

      • memory/4208-122-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-124-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-127-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-129-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-130-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-131-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-132-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-135-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-136-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-137-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-138-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-140-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-144-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-146-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-145-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-143-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-139-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-147-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-149-0x000001AE472C0000-0x000001AE472D0000-memory.dmp

        Filesize

        64KB

      • memory/4208-148-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-151-0x000001AE474F0000-0x000001AE47500000-memory.dmp

        Filesize

        64KB

      • memory/4208-150-0x000001AE474E0000-0x000001AE474F0000-memory.dmp

        Filesize

        64KB

      • memory/4208-152-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-153-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-156-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-157-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-159-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-160-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-158-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-163-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-166-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-168-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-167-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-170-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-173-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-174-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-169-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-175-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-176-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-178-0x000001AE474F0000-0x000001AE47500000-memory.dmp

        Filesize

        64KB

      • memory/4208-177-0x000001AE474E0000-0x000001AE474F0000-memory.dmp

        Filesize

        64KB

      • memory/4208-180-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-179-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-181-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-182-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-184-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-183-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-185-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-186-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-189-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-190-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-191-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-192-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-193-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-196-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-197-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-198-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-199-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-200-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-201-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-204-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-205-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-206-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-207-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-209-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-208-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-211-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-212-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-210-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-213-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-214-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-217-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-218-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-219-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-220-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-221-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-222-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-225-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-226-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-262-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-263-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-261-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-264-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-265-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-266-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-267-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-268-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-269-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-294-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-295-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-293-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-297-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-296-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-299-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-298-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-300-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-302-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-301-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-328-0x000001AE469A0000-0x000001AE469B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-327-0x000001AE46790000-0x000001AE467A0000-memory.dmp

        Filesize

        64KB

      • memory/4208-329-0x000001AE486A0000-0x000001AE486B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-330-0x000001AE486A0000-0x000001AE486B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-331-0x000001AE486A0000-0x000001AE486B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-333-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-332-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-335-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-334-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-336-0x000001AE48650000-0x000001AE48660000-memory.dmp

        Filesize

        64KB

      • memory/4208-338-0x000001AE486A0000-0x000001AE486B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-337-0x000001AE486A0000-0x000001AE486B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-339-0x000001AE486A0000-0x000001AE486B0000-memory.dmp

        Filesize

        64KB

      • memory/4208-344-0x000001AE474E0000-0x000001AE474E3000-memory.dmp

        Filesize

        12KB

      • memory/4208-345-0x000001AE48650000-0x000001AE48653000-memory.dmp

        Filesize

        12KB

      • memory/4732-118-0x0000000000000000-mapping.dmp