Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 12:57
Static task
static1
Behavioral task
behavioral1
Sample
e65e5ec24ee55f1b2a365c9de01e21baa1ad6a74578e7aa07a7b1b42815f8095.js
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e65e5ec24ee55f1b2a365c9de01e21baa1ad6a74578e7aa07a7b1b42815f8095.js
Resource
win10v2004-20240508-en
General
-
Target
e65e5ec24ee55f1b2a365c9de01e21baa1ad6a74578e7aa07a7b1b42815f8095.js
-
Size
5.5MB
-
MD5
60ed21699fe726ae8cc28836f8b8dfc2
-
SHA1
b42008ac95e568b9ff07e2ac616fe769fe87ee0a
-
SHA256
e65e5ec24ee55f1b2a365c9de01e21baa1ad6a74578e7aa07a7b1b42815f8095
-
SHA512
8af276af30c1c7952bf5d0e8ce235eaebb72000325ed04b73f29e6898a765667803c392687e299b48ad8df333cac9b2b35a56ccca405949e97dc36789538d9b0
-
SSDEEP
49152:R0ytwpCQK+4X0ytwpCQK+4X0ytwpCQK+4X0ytwpCQK+4X0ytwpCQK+4p:RppppP
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2512 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2512 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
taskeng.exewscript.EXEcscript.exedescription pid process target process PID 2568 wrote to memory of 1744 2568 taskeng.exe wscript.EXE PID 2568 wrote to memory of 1744 2568 taskeng.exe wscript.EXE PID 2568 wrote to memory of 1744 2568 taskeng.exe wscript.EXE PID 1744 wrote to memory of 2996 1744 wscript.EXE cscript.exe PID 1744 wrote to memory of 2996 1744 wscript.EXE cscript.exe PID 1744 wrote to memory of 2996 1744 wscript.EXE cscript.exe PID 2996 wrote to memory of 2512 2996 cscript.exe powershell.exe PID 2996 wrote to memory of 2512 2996 cscript.exe powershell.exe PID 2996 wrote to memory of 2512 2996 cscript.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\e65e5ec24ee55f1b2a365c9de01e21baa1ad6a74578e7aa07a7b1b42815f8095.js1⤵PID:1872
-
C:\Windows\system32\taskeng.exetaskeng.exe {82E304E3-6E3B-4FB0-8CD0-50CFD11869AC} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE CHEMIC~1.JS2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "CHEMIC~1.JS"3⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46.5MB
MD5b0b77196da0756d6c076d882e85de681
SHA1252bf3d03c3b6fc973a2dc9d3913c6eed32a1dc4
SHA2565ef1b8b860a81cce9d61196500ba101b5183a9feb390811a98e5c2d7917cd4a1
SHA5125a9d08a1d63f772b59e5258d8baa0b02d6daa67231e73a93a55363fddf336c8d5dd5e1dd377005d47df68f06327c56316d927a4d4dd350feccd81b754f591b78