Analysis
- max time kernel
137s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
14/05/2024, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
8616e852ca4040aa4fcda50244a4813f9ac777824f536c8ba92c5dbdae94e7e7.js
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8616e852ca4040aa4fcda50244a4813f9ac777824f536c8ba92c5dbdae94e7e7.js
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 8616e852ca4040aa4fcda50244a4813f9ac777824f536c8ba92c5dbdae94e7e7.js
- Size 8.8MB
- Sample240514-qee94agh27
- SHA256 8616e852ca4040aa4fcda50244a4813f9ac777824f536c8ba92c5dbdae94e7e7
- MD5 cdc6a05e97f1c921fd942e29b612ce38
- SHA1 64c02c41ffeaf646cd73b0e183287dd734e228e3
- SHA512 c938b3f7f61abfd2dc361d72599271b01c7d6e76ee73881703a222ce11fb547737ea9966b25ebb1537ee816dc53de2c4b5f47dfee24e3d0e0698153fe0c33617
- SSDEEP 49152:ViytwpCQK+M3iytwpCQK+M3iytwpCQK+M3iytwpCQK+M3iytwpCQK+M3iytwpCQi:V9999999f
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Blocklisted process makes network request 3 IoCs
flow pid Process 61 3648 powershell.exe 75 3648 powershell.exe 78 3648 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation wscript.EXE - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3648 powershell.exe Token: SeIncreaseQuotaPrivilege 3648 powershell.exe Token: SeSecurityPrivilege 3648 powershell.exe Token: SeTakeOwnershipPrivilege 3648 powershell.exe Token: SeLoadDriverPrivilege 3648 powershell.exe Token: SeSystemProfilePrivilege 3648 powershell.exe Token: SeSystemtimePrivilege 3648 powershell.exe Token: SeProfSingleProcessPrivilege 3648 powershell.exe Token: SeIncBasePriorityPrivilege 3648 powershell.exe Token: SeCreatePagefilePrivilege 3648 powershell.exe Token: SeBackupPrivilege 3648 powershell.exe Token: SeRestorePrivilege 3648 powershell.exe Token: SeShutdownPrivilege 3648 powershell.exe Token: SeDebugPrivilege 3648 powershell.exe Token: SeSystemEnvironmentPrivilege 3648 powershell.exe Token: SeRemoteShutdownPrivilege 3648 powershell.exe Token: SeUndockPrivilege 3648 powershell.exe Token: SeManageVolumePrivilege 3648 powershell.exe Token: 33 3648 powershell.exe Token: 34 3648 powershell.exe Token: 35 3648 powershell.exe Token: 36 3648 powershell.exe Token: SeIncreaseQuotaPrivilege 3648 powershell.exe Token: SeSecurityPrivilege 3648 powershell.exe Token: SeTakeOwnershipPrivilege 3648 powershell.exe Token: SeLoadDriverPrivilege 3648 powershell.exe Token: SeSystemProfilePrivilege 3648 powershell.exe Token: SeSystemtimePrivilege 3648 powershell.exe Token: SeProfSingleProcessPrivilege 3648 powershell.exe Token: SeIncBasePriorityPrivilege 3648 powershell.exe Token: SeCreatePagefilePrivilege 3648 powershell.exe Token: SeBackupPrivilege 3648 powershell.exe Token: SeRestorePrivilege 3648 powershell.exe Token: SeShutdownPrivilege 3648 powershell.exe Token: SeDebugPrivilege 3648 powershell.exe Token: SeSystemEnvironmentPrivilege 3648 powershell.exe Token: SeRemoteShutdownPrivilege 3648 powershell.exe Token: SeUndockPrivilege 3648 powershell.exe Token: SeManageVolumePrivilege 3648 powershell.exe Token: 33 3648 powershell.exe Token: 34 3648 powershell.exe Token: 35 3648 powershell.exe Token: 36 3648 powershell.exe Token: SeIncreaseQuotaPrivilege 3648 powershell.exe Token: SeSecurityPrivilege 3648 powershell.exe Token: SeTakeOwnershipPrivilege 3648 powershell.exe Token: SeLoadDriverPrivilege 3648 powershell.exe Token: SeSystemProfilePrivilege 3648 powershell.exe Token: SeSystemtimePrivilege 3648 powershell.exe Token: SeProfSingleProcessPrivilege 3648 powershell.exe Token: SeIncBasePriorityPrivilege 3648 powershell.exe Token: SeCreatePagefilePrivilege 3648 powershell.exe Token: SeBackupPrivilege 3648 powershell.exe Token: SeRestorePrivilege 3648 powershell.exe Token: SeShutdownPrivilege 3648 powershell.exe Token: SeDebugPrivilege 3648 powershell.exe Token: SeSystemEnvironmentPrivilege 3648 powershell.exe Token: SeRemoteShutdownPrivilege 3648 powershell.exe Token: SeUndockPrivilege 3648 powershell.exe Token: SeManageVolumePrivilege 3648 powershell.exe Token: 33 3648 powershell.exe Token: 34 3648 powershell.exe Token: 35 3648 powershell.exe Token: 36 3648 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4952 wrote to memory of 3620 4952 wscript.EXE 99 PID 4952 wrote to memory of 3620 4952 wscript.EXE 99 PID 3620 wrote to memory of 3648 3620 cscript.exe 101 PID 3620 wrote to memory of 3648 3620 cscript.exe 101 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\8616e852ca4040aa4fcda50244a4813f9ac777824f536c8ba92c5dbdae94e7e7.js1⤵PID:4404
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE TEAMPE~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "TEAMPE~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5eholmc.utb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Sun\TEAMPE~1.JS
- Size 42.4MB
- SHA256 5b5b51a693e907c6a6b1e3d139a9e91514c0b8826fb1a203314884d03e7779ea
- MD5 fa02d295028d6ed0c8cc1e9646f21956
- SHA1 7000de56509cdc33421fbe2643a5fdc326ff027c
- SHA512 3c2fc06eceee1c97002e9e612464e715f7fd797bc5671b5f9be697dca89d165526008cecb8ce9e6385d09b824121a5a4129d8ab1b71382181717fce48c31beef
- SSDEEP 3072:RWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:G
- MD5 SHA1 SHA512 SSDEEP