Analysis
- max time kernel
1795s - max time network
1799s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
illinois mold laws 93833.js
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
illinois mold laws 93833.js
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
illinois mold laws 93833.js
Resource
win11-20240508-en
windows11-21h2-x64
7 signatures
1800 seconds
General
- Target illinois mold laws 93833.js
- Size 6.6MB
- Sample240618-sle9sayfqb
- SHA256 309c5e86c1aea1c56c1042e2d8ed8579bf712e8b3ba92486f04c0300a6d13608
- MD5 69b91189949561cf743e11c1339cae53
- SHA1 70a2b77219d0530e388335a9da62f44616b5bb96
- SHA512 dd85a1071818c2caf46034597a2a9b07b0e1d352dd3bd0d5a8969e2143a1e527dd0e36bd5f9b514b17ef71649a5f84609f023194826e9c64a07a692b75a3c2eb
- SSDEEP 49152:VXytwpCQK+ZjXytwpCQK+ZjXytwpCQK+ZjXytwpCQK+ZjXytwpCQK+ZjXytwpCQV:V55555b
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Blocklisted process makes network request 64 IoCs
flow pid Process 43 736 powershell.exe 51 736 powershell.exe 57 736 powershell.exe 60 736 powershell.exe 62 736 powershell.exe 65 736 powershell.exe 66 736 powershell.exe 67 736 powershell.exe 68 736 powershell.exe 70 736 powershell.exe 72 736 powershell.exe 75 736 powershell.exe 77 736 powershell.exe 80 736 powershell.exe 85 736 powershell.exe 89 736 powershell.exe 91 736 powershell.exe 93 736 powershell.exe 96 736 powershell.exe 97 736 powershell.exe 98 736 powershell.exe 100 736 powershell.exe 102 736 powershell.exe 103 736 powershell.exe 105 736 powershell.exe 106 736 powershell.exe 107 736 powershell.exe 108 736 powershell.exe 110 736 powershell.exe 111 736 powershell.exe 113 736 powershell.exe 115 736 powershell.exe 117 736 powershell.exe 118 736 powershell.exe 119 736 powershell.exe 121 736 powershell.exe 124 736 powershell.exe 126 736 powershell.exe 127 736 powershell.exe 128 736 powershell.exe 130 736 powershell.exe 131 736 powershell.exe 132 736 powershell.exe 133 736 powershell.exe 134 736 powershell.exe 137 736 powershell.exe 138 736 powershell.exe 139 736 powershell.exe 140 736 powershell.exe 142 736 powershell.exe 143 736 powershell.exe 144 736 powershell.exe 146 736 powershell.exe 148 736 powershell.exe 149 736 powershell.exe 151 736 powershell.exe 154 736 powershell.exe 155 736 powershell.exe 157 736 powershell.exe 158 736 powershell.exe 160 736 powershell.exe 161 736 powershell.exe 164 736 powershell.exe 166 736 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wscript.EXE - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe 736 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 736 powershell.exe Token: SeIncreaseQuotaPrivilege 736 powershell.exe Token: SeSecurityPrivilege 736 powershell.exe Token: SeTakeOwnershipPrivilege 736 powershell.exe Token: SeLoadDriverPrivilege 736 powershell.exe Token: SeSystemProfilePrivilege 736 powershell.exe Token: SeSystemtimePrivilege 736 powershell.exe Token: SeProfSingleProcessPrivilege 736 powershell.exe Token: SeIncBasePriorityPrivilege 736 powershell.exe Token: SeCreatePagefilePrivilege 736 powershell.exe Token: SeBackupPrivilege 736 powershell.exe Token: SeRestorePrivilege 736 powershell.exe Token: SeShutdownPrivilege 736 powershell.exe Token: SeDebugPrivilege 736 powershell.exe Token: SeSystemEnvironmentPrivilege 736 powershell.exe Token: SeRemoteShutdownPrivilege 736 powershell.exe Token: SeUndockPrivilege 736 powershell.exe Token: SeManageVolumePrivilege 736 powershell.exe Token: 33 736 powershell.exe Token: 34 736 powershell.exe Token: 35 736 powershell.exe Token: 36 736 powershell.exe Token: SeIncreaseQuotaPrivilege 736 powershell.exe Token: SeSecurityPrivilege 736 powershell.exe Token: SeTakeOwnershipPrivilege 736 powershell.exe Token: SeLoadDriverPrivilege 736 powershell.exe Token: SeSystemProfilePrivilege 736 powershell.exe Token: SeSystemtimePrivilege 736 powershell.exe Token: SeProfSingleProcessPrivilege 736 powershell.exe Token: SeIncBasePriorityPrivilege 736 powershell.exe Token: SeCreatePagefilePrivilege 736 powershell.exe Token: SeBackupPrivilege 736 powershell.exe Token: SeRestorePrivilege 736 powershell.exe Token: SeShutdownPrivilege 736 powershell.exe Token: SeDebugPrivilege 736 powershell.exe Token: SeSystemEnvironmentPrivilege 736 powershell.exe Token: SeRemoteShutdownPrivilege 736 powershell.exe Token: SeUndockPrivilege 736 powershell.exe Token: SeManageVolumePrivilege 736 powershell.exe Token: 33 736 powershell.exe Token: 34 736 powershell.exe Token: 35 736 powershell.exe Token: 36 736 powershell.exe Token: SeIncreaseQuotaPrivilege 736 powershell.exe Token: SeSecurityPrivilege 736 powershell.exe Token: SeTakeOwnershipPrivilege 736 powershell.exe Token: SeLoadDriverPrivilege 736 powershell.exe Token: SeSystemProfilePrivilege 736 powershell.exe Token: SeSystemtimePrivilege 736 powershell.exe Token: SeProfSingleProcessPrivilege 736 powershell.exe Token: SeIncBasePriorityPrivilege 736 powershell.exe Token: SeCreatePagefilePrivilege 736 powershell.exe Token: SeBackupPrivilege 736 powershell.exe Token: SeRestorePrivilege 736 powershell.exe Token: SeShutdownPrivilege 736 powershell.exe Token: SeDebugPrivilege 736 powershell.exe Token: SeSystemEnvironmentPrivilege 736 powershell.exe Token: SeRemoteShutdownPrivilege 736 powershell.exe Token: SeUndockPrivilege 736 powershell.exe Token: SeManageVolumePrivilege 736 powershell.exe Token: 33 736 powershell.exe Token: 34 736 powershell.exe Token: 35 736 powershell.exe Token: 36 736 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 532 wrote to memory of 436 532 wscript.EXE 103 PID 532 wrote to memory of 436 532 wscript.EXE 103 PID 436 wrote to memory of 736 436 cscript.exe 105 PID 436 wrote to memory of 736 436 cscript.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\illinois mold laws 93833.js"1⤵PID:3468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4336,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:81⤵PID:2764
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE GRASTO~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "GRASTO~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1040,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:81⤵PID:1272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g0nj1fkh.lre.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\GRASTO~1.JS
- Size 41.2MB
- SHA256 db3fddbdcd67b2958063342ba72296cd7005f65f8d04fcb89b9b1011a83c5f02
- MD5 5a7115598cd621d72717942276134759
- SHA1 9f9a33c57ed4181df3a3cf3af91518c1252827e8
- SHA512 a622a3f3ca4e62c98ad76f6cd397397e9d923190743c271c0e3e57208f866ac5acfdd721f2b5b90b59218af7582e89553230e8b9d9cc6dc311285defee4297c5
- SSDEEP 6144:RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVt:z
- MD5 SHA1 SHA512 SSDEEP