Analysis
-
max time kernel
299s -
max time network
307s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
pa collective agreement pay 81727.js
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
pa collective agreement pay 81727.js
-
Size
5.5MB
-
MD5
6524c31a80c61c2d255cbeb448f7ed0e
-
SHA1
d4481a617ef1501e00422f8f56e5a79b27120d08
-
SHA256
7be565a3ba4a8ac193f32053f352b09bfa301411d84d256dd5b886040d6b265e
-
SHA512
63d48c8be16616919aa8ed5e5f61fb68d4ff6502ca1d1ec05867c3f48ee5fafb48417ca83fe3d9003cd7fcfba3dfaac569107b66a1678c674a995bbfa00769c9
-
SSDEEP
49152:rAytwpCQK+0lAytwpCQK+0lAytwpCQK+0lAytwpCQK+0lAytwpCQK+0p:rXXXXj
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 9 IoCs
flow pid Process 59 2524 powershell.exe 73 2524 powershell.exe 76 2524 powershell.exe 78 2524 powershell.exe 80 2524 powershell.exe 82 2524 powershell.exe 84 2524 powershell.exe 86 2524 powershell.exe 88 2524 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe 2524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2524 powershell.exe Token: SeIncreaseQuotaPrivilege 2524 powershell.exe Token: SeSecurityPrivilege 2524 powershell.exe Token: SeTakeOwnershipPrivilege 2524 powershell.exe Token: SeLoadDriverPrivilege 2524 powershell.exe Token: SeSystemProfilePrivilege 2524 powershell.exe Token: SeSystemtimePrivilege 2524 powershell.exe Token: SeProfSingleProcessPrivilege 2524 powershell.exe Token: SeIncBasePriorityPrivilege 2524 powershell.exe Token: SeCreatePagefilePrivilege 2524 powershell.exe Token: SeBackupPrivilege 2524 powershell.exe Token: SeRestorePrivilege 2524 powershell.exe Token: SeShutdownPrivilege 2524 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeSystemEnvironmentPrivilege 2524 powershell.exe Token: SeRemoteShutdownPrivilege 2524 powershell.exe Token: SeUndockPrivilege 2524 powershell.exe Token: SeManageVolumePrivilege 2524 powershell.exe Token: 33 2524 powershell.exe Token: 34 2524 powershell.exe Token: 35 2524 powershell.exe Token: 36 2524 powershell.exe Token: SeIncreaseQuotaPrivilege 2524 powershell.exe Token: SeSecurityPrivilege 2524 powershell.exe Token: SeTakeOwnershipPrivilege 2524 powershell.exe Token: SeLoadDriverPrivilege 2524 powershell.exe Token: SeSystemProfilePrivilege 2524 powershell.exe Token: SeSystemtimePrivilege 2524 powershell.exe Token: SeProfSingleProcessPrivilege 2524 powershell.exe Token: SeIncBasePriorityPrivilege 2524 powershell.exe Token: SeCreatePagefilePrivilege 2524 powershell.exe Token: SeBackupPrivilege 2524 powershell.exe Token: SeRestorePrivilege 2524 powershell.exe Token: SeShutdownPrivilege 2524 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeSystemEnvironmentPrivilege 2524 powershell.exe Token: SeRemoteShutdownPrivilege 2524 powershell.exe Token: SeUndockPrivilege 2524 powershell.exe Token: SeManageVolumePrivilege 2524 powershell.exe Token: 33 2524 powershell.exe Token: 34 2524 powershell.exe Token: 35 2524 powershell.exe Token: 36 2524 powershell.exe Token: SeIncreaseQuotaPrivilege 2524 powershell.exe Token: SeSecurityPrivilege 2524 powershell.exe Token: SeTakeOwnershipPrivilege 2524 powershell.exe Token: SeLoadDriverPrivilege 2524 powershell.exe Token: SeSystemProfilePrivilege 2524 powershell.exe Token: SeSystemtimePrivilege 2524 powershell.exe Token: SeProfSingleProcessPrivilege 2524 powershell.exe Token: SeIncBasePriorityPrivilege 2524 powershell.exe Token: SeCreatePagefilePrivilege 2524 powershell.exe Token: SeBackupPrivilege 2524 powershell.exe Token: SeRestorePrivilege 2524 powershell.exe Token: SeShutdownPrivilege 2524 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeSystemEnvironmentPrivilege 2524 powershell.exe Token: SeRemoteShutdownPrivilege 2524 powershell.exe Token: SeUndockPrivilege 2524 powershell.exe Token: SeManageVolumePrivilege 2524 powershell.exe Token: 33 2524 powershell.exe Token: 34 2524 powershell.exe Token: 35 2524 powershell.exe Token: 36 2524 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1180 wrote to memory of 3416 1180 wscript.EXE 99 PID 1180 wrote to memory of 3416 1180 wscript.EXE 99 PID 3416 wrote to memory of 2524 3416 cscript.exe 101 PID 3416 wrote to memory of 2524 3416 cscript.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\pa collective agreement pay 81727.js"1⤵PID:2796
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE HUTHWA~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "HUTHWA~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
46.0MB
MD5069e4d6f747168ba96b74f972ba2dc45
SHA1efa6711470250b3876eae22fb6b8ca23939bd725
SHA256cb0012b0ad60adeaa719ad1443f7f5c89125c0f2ad915e258ba38830c121de4d
SHA512dff3384cf904fa5132805d6f084aeb88f7e943e8a8c4a5d91a0bfc066838d56a89402681cc6ba947aab7d73a92c8c2593a18f49c404b630c6b2179125b9ec0e3