Resubmissions

21-05-2024 21:55

240521-1sx26sbf47 10

21-05-2024 21:51

240521-1qywpabe75 10

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-05-2024 21:51

General

  • Target

    call and put contracts 16318.js

  • Size

    8.8MB

  • MD5

    88ab74d84774855d0a2c24d5a1b50389

  • SHA1

    83ce4e759d3443332eb223689717b4895bd4e6cc

  • SHA256

    f8f3fa45eced0c32fbbf912f3f8ba6100a8b59e14f12a125c88340a47cf7e57b

  • SHA512

    cf5adf3cb923ddb264b6f2182be043859c3c16544bbc2d3c01f0469ca6a25702ece7b140438928067226a334d88ac7567e808ecab5b97731678a2e948e399e87

  • SSDEEP

    49152:kYytwpCQK+aGYytwpCQK+aGYytwpCQK+aGYytwpCQK+aGYytwpCQK+aGYytwpCQO:f

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\call and put contracts 16318.js"
    1⤵
      PID:2360
    • C:\Windows\system32\wscript.EXE
      C:\Windows\system32\wscript.EXE GLOBAL~1.JS
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3404
      • C:\Windows\System32\cscript.exe
        "C:\Windows\System32\cscript.exe" "GLOBAL~1.JS"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5012
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1448

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Command and Scripting Interpreter

    1
    T1059

    JavaScript

    1
    T1059.007

    Discovery

    System Information Discovery

    1
    T1082

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wi0dcdno.maz.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Sun\GLOBAL~1.JS
      Filesize

      43.3MB

      MD5

      4fa4b4d068f722cbfe719be7ab4c8c52

      SHA1

      1b7b04c22e9bf7075f9c8b6ba88effe50f42bfc5

      SHA256

      a92381a403a1463b64ebc547de7ec2a4225a7755d23c4e56503582b9cb33c3c8

      SHA512

      486b1fa557da6ee6ce601514d2682767d3350ffc66fbcf29b50aba6b19d30bd4027bb086dfa5f0599294f31fa16ad598df8ba4e4560ce8f042098ec6ef470643

    • memory/1448-5-0x0000020DF5630000-0x0000020DF5652000-memory.dmp
      Filesize

      136KB

    • memory/1448-12-0x0000020DF5870000-0x0000020DF58B6000-memory.dmp
      Filesize

      280KB