Analysis

  • max time kernel
    704s
  • max time network
    618s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-09-2022 11:41

General

  • Target

    How_to_edit_a_legal_document_in_word (gtfo).js

  • Size

    483KB

  • MD5

    3301face310e530f016ac62aae10b082

  • SHA1

    f1fb2790c07af0eef3cbd5dcdd3948e7cb8e1f44

  • SHA256

    4d87f3a6c1ab70ac27bdaa99a9b481a669c0a53c3160d7fe35a6142d3c3297ef

  • SHA512

    673fb99444fa6c3a5c2626914c83cd77fbdc5a9ea4c481c2562409c04d6598f530431af70e77ca6fc7a9f9ffe00171fe2fed721a0e02cd1ef328dc78d7386a7c

  • SSDEEP

    6144:tQPXNOulaxl42hEfD3zA7Qiagmd4iLAmWR6wSF:iwhEfD3zniagmd4iLAmWR69

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 6 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\How_to_edit_a_legal_document_in_word (gtfo).js"
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    PID:2744
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4760
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\UpdateStart\" -ad -an -ai#7zMap9703:78:7zEvent19892
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4456
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\UpdateStart\" -ad -an -ai#7zMap7696:78:7zEvent26781
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:528
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3804
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\How_to_edit_a_legal_document_in_word (gtfo).js"
      1⤵
        PID:4704
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\How_to_edit_a_legal_document_in_word (gtfo).js"
        1⤵
          PID:1872

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads