Analysis
- max time kernel
148s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
are cell phone contracts worth it 89075.js
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
are cell phone contracts worth it 89075.js
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target are cell phone contracts worth it 89075.js
- Size 22.5MB
- Sample240517-pcvrbsge7t
- SHA256 29ac4c5b8a848e6545891539db188cbfba8ac3dd25c04fe9ab1c1f6ffb7c2a02
- MD5 12a998e2db6376b5e2734b9c95d765be
- SHA1 b13a9c7e213b88848c7971f1b3c975c7d9507682
- SHA512 43c53103d4e37f83ff9d3010efccc7b9ba660b8845be6634eae296cb72cf9b0fc51cf85f49482d6421a69fd782502b7dfa28021c2f2e8464ac09f98eb248de36
- SSDEEP 49152:j7sbzjCxbTqHlp43s8N0IThB415zlYzYBuO++8yMY3Q5/CWNGgEx3quAQ8gKcEBH:d
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Blocklisted process makes network request 3 IoCs
flow pid Process 62 1188 powershell.exe 70 1188 powershell.exe 72 1188 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation wscript.EXE - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1188 powershell.exe Token: SeIncreaseQuotaPrivilege 1188 powershell.exe Token: SeSecurityPrivilege 1188 powershell.exe Token: SeTakeOwnershipPrivilege 1188 powershell.exe Token: SeLoadDriverPrivilege 1188 powershell.exe Token: SeSystemProfilePrivilege 1188 powershell.exe Token: SeSystemtimePrivilege 1188 powershell.exe Token: SeProfSingleProcessPrivilege 1188 powershell.exe Token: SeIncBasePriorityPrivilege 1188 powershell.exe Token: SeCreatePagefilePrivilege 1188 powershell.exe Token: SeBackupPrivilege 1188 powershell.exe Token: SeRestorePrivilege 1188 powershell.exe Token: SeShutdownPrivilege 1188 powershell.exe Token: SeDebugPrivilege 1188 powershell.exe Token: SeSystemEnvironmentPrivilege 1188 powershell.exe Token: SeRemoteShutdownPrivilege 1188 powershell.exe Token: SeUndockPrivilege 1188 powershell.exe Token: SeManageVolumePrivilege 1188 powershell.exe Token: 33 1188 powershell.exe Token: 34 1188 powershell.exe Token: 35 1188 powershell.exe Token: 36 1188 powershell.exe Token: SeIncreaseQuotaPrivilege 1188 powershell.exe Token: SeSecurityPrivilege 1188 powershell.exe Token: SeTakeOwnershipPrivilege 1188 powershell.exe Token: SeLoadDriverPrivilege 1188 powershell.exe Token: SeSystemProfilePrivilege 1188 powershell.exe Token: SeSystemtimePrivilege 1188 powershell.exe Token: SeProfSingleProcessPrivilege 1188 powershell.exe Token: SeIncBasePriorityPrivilege 1188 powershell.exe Token: SeCreatePagefilePrivilege 1188 powershell.exe Token: SeBackupPrivilege 1188 powershell.exe Token: SeRestorePrivilege 1188 powershell.exe Token: SeShutdownPrivilege 1188 powershell.exe Token: SeDebugPrivilege 1188 powershell.exe Token: SeSystemEnvironmentPrivilege 1188 powershell.exe Token: SeRemoteShutdownPrivilege 1188 powershell.exe Token: SeUndockPrivilege 1188 powershell.exe Token: SeManageVolumePrivilege 1188 powershell.exe Token: 33 1188 powershell.exe Token: 34 1188 powershell.exe Token: 35 1188 powershell.exe Token: 36 1188 powershell.exe Token: SeIncreaseQuotaPrivilege 1188 powershell.exe Token: SeSecurityPrivilege 1188 powershell.exe Token: SeTakeOwnershipPrivilege 1188 powershell.exe Token: SeLoadDriverPrivilege 1188 powershell.exe Token: SeSystemProfilePrivilege 1188 powershell.exe Token: SeSystemtimePrivilege 1188 powershell.exe Token: SeProfSingleProcessPrivilege 1188 powershell.exe Token: SeIncBasePriorityPrivilege 1188 powershell.exe Token: SeCreatePagefilePrivilege 1188 powershell.exe Token: SeBackupPrivilege 1188 powershell.exe Token: SeRestorePrivilege 1188 powershell.exe Token: SeShutdownPrivilege 1188 powershell.exe Token: SeDebugPrivilege 1188 powershell.exe Token: SeSystemEnvironmentPrivilege 1188 powershell.exe Token: SeRemoteShutdownPrivilege 1188 powershell.exe Token: SeUndockPrivilege 1188 powershell.exe Token: SeManageVolumePrivilege 1188 powershell.exe Token: 33 1188 powershell.exe Token: 34 1188 powershell.exe Token: 35 1188 powershell.exe Token: 36 1188 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 556 wrote to memory of 3672 556 wscript.EXE 99 PID 556 wrote to memory of 3672 556 wscript.EXE 99 PID 3672 wrote to memory of 1188 3672 cscript.exe 103 PID 3672 wrote to memory of 1188 3672 cscript.exe 103 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\are cell phone contracts worth it 89075.js"1⤵PID:2492
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE PLASTI~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "PLASTI~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tqu2sibn.hlb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Sun\PLASTI~1.JS
- Size 43.8MB
- SHA256 5d5b0be02e017d471cb0845312a52889d52b9cf337bf8d9998b35380cc651a04
- MD5 7f40f905f4ed6f48b88f209a93d6cae6
- SHA1 c270fab756d48be9ba61b7472d5e40227886c615
- SHA512 e15616533b500ca2f9ec6985f7906c092d8b3f50e6820b4ed467653893a2f8968c46019c041f4a80ccc2abf56a3067bc069ce331bf074593f37a9b2ed9dd64cf
- SSDEEP 786432:0CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCx:0CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCx
- MD5 SHA1 SHA512 SSDEEP