Resubmissions

08-09-2022 12:37

220908-ptplmsbgck 10

08-09-2022 12:30

220908-pprv7seeg9 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    08-09-2022 12:37

General

  • Target

    2426d4b21e5f3804a7bdd97d6d2eaa5d80874a32cbc8ccce846eaaf34ca033dc.js

  • Size

    483KB

  • MD5

    5e54370bed87473308b7ec0935a36337

  • SHA1

    fdbd250b7b64e23838cf7c14e35ce3fa6e4802af

  • SHA256

    2426d4b21e5f3804a7bdd97d6d2eaa5d80874a32cbc8ccce846eaaf34ca033dc

  • SHA512

    b06615e26cce40ac7f84c813694cfce62407d37348b7584c0985fdd795b4b6851008341241551a0bb9f6badd84f8bdf14eb064eba487d25dada6b74f7c30bffe

  • SSDEEP

    6144:AoQpXS3ulaxl4HhEfD3rgA7Viagmd4iLAmWR6TSd:AiOhEfD38Siagmd4iLAmWR66

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 3 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\2426d4b21e5f3804a7bdd97d6d2eaa5d80874a32cbc8ccce846eaaf34ca033dc.js
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    PID:1356

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads