Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-09-2022 14:29

General

  • Target

    cf289365a712b071fb54a4fe548f55c4f569cf21471267bd4abda272a07f0177.js

  • Size

    483KB

  • MD5

    9a98fbf79248e5ec47d68c6079911373

  • SHA1

    f4dcef02663f87c5be68ed14c9da3894bf5ee4ad

  • SHA256

    cf289365a712b071fb54a4fe548f55c4f569cf21471267bd4abda272a07f0177

  • SHA512

    688c41d5196567a205131a102f7bdbb77a6cf0a1ecc67890cf3a5ccc26656a3a04f772145ba8d32773ef86a9802211bb178814be4cc8ff1cc63420df0e088c35

  • SSDEEP

    6144:2QlqGTTulaxl4HhEfD3CA79iagmd4iLAmWm6xbF:1uhEfD3Ceiagmd4iLAmWm6j

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\cf289365a712b071fb54a4fe548f55c4f569cf21471267bd4abda272a07f0177.js
    1⤵
    • Blocklisted process makes network request
    PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads