Resubmissions

12-09-2022 19:13

220912-xw6lyahfhr 10

Analysis

  • max time kernel
    225s
  • max time network
    229s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-09-2022 19:13

General

  • Target

    Ttc_local_113_collective_agreement (gjz).js

  • Size

    483KB

  • MD5

    9a98fbf79248e5ec47d68c6079911373

  • SHA1

    f4dcef02663f87c5be68ed14c9da3894bf5ee4ad

  • SHA256

    cf289365a712b071fb54a4fe548f55c4f569cf21471267bd4abda272a07f0177

  • SHA512

    688c41d5196567a205131a102f7bdbb77a6cf0a1ecc67890cf3a5ccc26656a3a04f772145ba8d32773ef86a9802211bb178814be4cc8ff1cc63420df0e088c35

  • SSDEEP

    6144:2QlqGTTulaxl4HhEfD3CA79iagmd4iLAmWm6xbF:1uhEfD3Ceiagmd4iLAmWm6j

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 3 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Ttc_local_113_collective_agreement (gjz).js"
    1⤵
    • Blocklisted process makes network request
    PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads