Analysis

  • max time kernel
    290s
  • max time network
    293s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2022 12:47

General

  • Target

    Airlines_under_agreement_with_bangkok_airways (eibcm).js

  • Size

    483KB

  • MD5

    d5cc3b51213e96e79430b473e4a6c1b7

  • SHA1

    82fbcdf0f91e6af506fbb1c0d83ae11133f6b0f7

  • SHA256

    e116b7b31ccddd17b1ed883d7cbeb290dd2da5e822fbed6bf555bf31c0d2a4cb

  • SHA512

    cc0e7df455950a663881503189b57b7244fe4c540bd9565c30edaa48959ef4ee4ad294536057efa2d7acb1eaa279a3c83c5eab9180fbe385eb02d1ad0d14eb53

  • SSDEEP

    6144:HQXifSXulaxl49hEfD3XA7riagmdNiLAmWR62HF:quhEfD3XWiagmdNiLAmWR6e

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 3 IoCs
  • Program crash 1 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Airlines_under_agreement_with_bangkok_airways (eibcm).js"
    1⤵
    • Blocklisted process makes network request
    PID:2284
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 460 -p 5076 -ip 5076
    1⤵
      PID:968
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 5076 -s 2708
      1⤵
      • Program crash
      PID:4688

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads