Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-09-2022 20:35

General

  • Target

    What_is_a_domiciliation_agreement (ie).js

  • Size

    483KB

  • MD5

    140a1f3782485e4b5581ac9c104e18e7

  • SHA1

    fed7b919c3b533e9c6ed9903d3b9ed1614b774b8

  • SHA256

    924f71e9039d10700fc39873204af6a2ab40b1df7715b59c44f9feeed70c5eb4

  • SHA512

    402214f801ceb5a7f925698815edde70c50649117ac96c922f6cf1ce5bcbf27cf4509674493e0234794196bf96ce625bcdb203e66cb9bcc262968c2f9562f69c

  • SSDEEP

    6144:wQVgibulaxl4ihEfDgvA7Wiagmd4iLAmWR6NIF:BLhEfDgvviagmd4iLAmWR6E

Score
10/10

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\What_is_a_domiciliation_agreement (ie).js"
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    PID:2264

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads