Analysis
-
max time kernel
277s -
max time network
281s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2022 12:07
Static task
static1
Behavioral task
behavioral1
Sample
710f2efbe32f719f6d3be0830b598aed5e5ce7aecd37bf1fda3ebe11e5737eba.js
Resource
win10v2004-20220901-en
General
-
Target
710f2efbe32f719f6d3be0830b598aed5e5ce7aecd37bf1fda3ebe11e5737eba.js
-
Size
483KB
-
MD5
5cc9ce54aacd8cda0b335a3d7be52fe1
-
SHA1
d510630848807220df5bfa54f8fdd329e596c1bd
-
SHA256
710f2efbe32f719f6d3be0830b598aed5e5ce7aecd37bf1fda3ebe11e5737eba
-
SHA512
07c29aed0c951dc0047f5283871b866fd2ff11ca76de19e8eee609ad877319e8d5bb88f32aa02abb537a62cc2cc6dc386c81c5fa39900e8167ae05f13213b6d2
-
SSDEEP
6144:vQaySTulaxl4khEfD3xA72iagmd4iLAmWR6CSy:1hhEfD3xTiagmd4iLAmWR6c
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 3 IoCs
Processes:
wscript.exeflow pid process 49 1088 wscript.exe 51 1088 wscript.exe 53 1088 wscript.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3556 2956 WerFault.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 49 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 51 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 53 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\710f2efbe32f719f6d3be0830b598aed5e5ce7aecd37bf1fda3ebe11e5737eba.js1⤵
- Blocklisted process makes network request
PID:1088
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 2956 -ip 29561⤵PID:3572
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2956 -s 8521⤵
- Program crash
PID:3556