Analysis
-
max time kernel
600s -
max time network
601s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
BUSINE~1.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BUSINE~1.js
Resource
win10v2004-20240426-en
General
-
Target
BUSINE~1.js
-
Size
43.2MB
-
MD5
63a99e04e435616bdc87fed55d0a3a2c
-
SHA1
87af1244405d3ed86e269f50982886d99b011c62
-
SHA256
467641ed625f257318da1de965a6288f89bfef47cec6dddc511709cd959a5219
-
SHA512
7fea274c200da726223ae6fabb93025c967dc850c4d3070b085f95b91654b7c97b24bdb61558ee855140c4213d9bf95699e6ce2a800bcac6e5451fd9603f8e1f
-
SSDEEP
49152:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxv:l
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 25 IoCs
Processes:
powershell.exeflow pid process 35 4636 powershell.exe 37 4636 powershell.exe 51 4636 powershell.exe 59 4636 powershell.exe 66 4636 powershell.exe 76 4636 powershell.exe 79 4636 powershell.exe 82 4636 powershell.exe 84 4636 powershell.exe 87 4636 powershell.exe 89 4636 powershell.exe 95 4636 powershell.exe 98 4636 powershell.exe 99 4636 powershell.exe 100 4636 powershell.exe 101 4636 powershell.exe 102 4636 powershell.exe 104 4636 powershell.exe 105 4636 powershell.exe 107 4636 powershell.exe 108 4636 powershell.exe 109 4636 powershell.exe 110 4636 powershell.exe 112 4636 powershell.exe 115 4636 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
powershell.exepid process 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe 4636 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4636 powershell.exe Token: SeIncreaseQuotaPrivilege 4636 powershell.exe Token: SeSecurityPrivilege 4636 powershell.exe Token: SeTakeOwnershipPrivilege 4636 powershell.exe Token: SeLoadDriverPrivilege 4636 powershell.exe Token: SeSystemProfilePrivilege 4636 powershell.exe Token: SeSystemtimePrivilege 4636 powershell.exe Token: SeProfSingleProcessPrivilege 4636 powershell.exe Token: SeIncBasePriorityPrivilege 4636 powershell.exe Token: SeCreatePagefilePrivilege 4636 powershell.exe Token: SeBackupPrivilege 4636 powershell.exe Token: SeRestorePrivilege 4636 powershell.exe Token: SeShutdownPrivilege 4636 powershell.exe Token: SeDebugPrivilege 4636 powershell.exe Token: SeSystemEnvironmentPrivilege 4636 powershell.exe Token: SeRemoteShutdownPrivilege 4636 powershell.exe Token: SeUndockPrivilege 4636 powershell.exe Token: SeManageVolumePrivilege 4636 powershell.exe Token: 33 4636 powershell.exe Token: 34 4636 powershell.exe Token: 35 4636 powershell.exe Token: 36 4636 powershell.exe Token: SeIncreaseQuotaPrivilege 4636 powershell.exe Token: SeSecurityPrivilege 4636 powershell.exe Token: SeTakeOwnershipPrivilege 4636 powershell.exe Token: SeLoadDriverPrivilege 4636 powershell.exe Token: SeSystemProfilePrivilege 4636 powershell.exe Token: SeSystemtimePrivilege 4636 powershell.exe Token: SeProfSingleProcessPrivilege 4636 powershell.exe Token: SeIncBasePriorityPrivilege 4636 powershell.exe Token: SeCreatePagefilePrivilege 4636 powershell.exe Token: SeBackupPrivilege 4636 powershell.exe Token: SeRestorePrivilege 4636 powershell.exe Token: SeShutdownPrivilege 4636 powershell.exe Token: SeDebugPrivilege 4636 powershell.exe Token: SeSystemEnvironmentPrivilege 4636 powershell.exe Token: SeRemoteShutdownPrivilege 4636 powershell.exe Token: SeUndockPrivilege 4636 powershell.exe Token: SeManageVolumePrivilege 4636 powershell.exe Token: 33 4636 powershell.exe Token: 34 4636 powershell.exe Token: 35 4636 powershell.exe Token: 36 4636 powershell.exe Token: SeIncreaseQuotaPrivilege 4636 powershell.exe Token: SeSecurityPrivilege 4636 powershell.exe Token: SeTakeOwnershipPrivilege 4636 powershell.exe Token: SeLoadDriverPrivilege 4636 powershell.exe Token: SeSystemProfilePrivilege 4636 powershell.exe Token: SeSystemtimePrivilege 4636 powershell.exe Token: SeProfSingleProcessPrivilege 4636 powershell.exe Token: SeIncBasePriorityPrivilege 4636 powershell.exe Token: SeCreatePagefilePrivilege 4636 powershell.exe Token: SeBackupPrivilege 4636 powershell.exe Token: SeRestorePrivilege 4636 powershell.exe Token: SeShutdownPrivilege 4636 powershell.exe Token: SeDebugPrivilege 4636 powershell.exe Token: SeSystemEnvironmentPrivilege 4636 powershell.exe Token: SeRemoteShutdownPrivilege 4636 powershell.exe Token: SeUndockPrivilege 4636 powershell.exe Token: SeManageVolumePrivilege 4636 powershell.exe Token: 33 4636 powershell.exe Token: 34 4636 powershell.exe Token: 35 4636 powershell.exe Token: 36 4636 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.execscript.exedescription pid process target process PID 1208 wrote to memory of 4000 1208 wscript.exe cscript.exe PID 1208 wrote to memory of 4000 1208 wscript.exe cscript.exe PID 4000 wrote to memory of 4636 4000 cscript.exe powershell.exe PID 4000 wrote to memory of 4636 4000 cscript.exe powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\BUSINE~1.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "BUSINE~1.js"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qsly5ort.jaw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4636-0-0x00007FFA342E3000-0x00007FFA342E5000-memory.dmpFilesize
8KB
-
memory/4636-6-0x000001BECEC10000-0x000001BECEC32000-memory.dmpFilesize
136KB
-
memory/4636-11-0x00007FFA342E0000-0x00007FFA34DA1000-memory.dmpFilesize
10.8MB
-
memory/4636-12-0x00007FFA342E0000-0x00007FFA34DA1000-memory.dmpFilesize
10.8MB
-
memory/4636-13-0x000001BECF120000-0x000001BECF164000-memory.dmpFilesize
272KB
-
memory/4636-14-0x000001BECF280000-0x000001BECF2F6000-memory.dmpFilesize
472KB
-
memory/4636-15-0x000001BECF4E0000-0x000001BECF50A000-memory.dmpFilesize
168KB
-
memory/4636-16-0x000001BECF4E0000-0x000001BECF504000-memory.dmpFilesize
144KB
-
memory/4636-18-0x00007FFA342E3000-0x00007FFA342E5000-memory.dmpFilesize
8KB
-
memory/4636-19-0x00007FFA342E0000-0x00007FFA34DA1000-memory.dmpFilesize
10.8MB