Analysis
-
max time kernel
282s -
max time network
286s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 14:18
Static task
static1
Behavioral task
behavioral1
Sample
collective bargaining agreement public service canada 75476.js
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
collective bargaining agreement public service canada 75476.js
-
Size
13.7MB
-
MD5
09f808a8e6517ec82c2753ed19ac734d
-
SHA1
85abf5a92fc8e84ec3cd018b3344b36e727facdd
-
SHA256
34fa85f029342b00dc2887280668014b7317d2d9bfb26bafd95a353e9a44d404
-
SHA512
ea94fff7d2c84270dafe079ccd5b9f549e0fa9f3fd6644f01634e1fc7e701e9ce2cd3f6a6387415290919f421a1fb98a3f62c02600e0c8ddafd71a5941be5d7e
-
SSDEEP
49152:YYRxr8uC0NjaCXkrCKgYRxr8uC0NjaCXkrCKf:eCz
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 9 IoCs
Processes:
powershell.exeflow pid Process 45 2004 powershell.exe 65 2004 powershell.exe 67 2004 powershell.exe 69 2004 powershell.exe 72 2004 powershell.exe 74 2004 powershell.exe 75 2004 powershell.exe 77 2004 powershell.exe 78 2004 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exepid Process 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe 2004 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 2004 powershell.exe Token: SeIncreaseQuotaPrivilege 2004 powershell.exe Token: SeSecurityPrivilege 2004 powershell.exe Token: SeTakeOwnershipPrivilege 2004 powershell.exe Token: SeLoadDriverPrivilege 2004 powershell.exe Token: SeSystemProfilePrivilege 2004 powershell.exe Token: SeSystemtimePrivilege 2004 powershell.exe Token: SeProfSingleProcessPrivilege 2004 powershell.exe Token: SeIncBasePriorityPrivilege 2004 powershell.exe Token: SeCreatePagefilePrivilege 2004 powershell.exe Token: SeBackupPrivilege 2004 powershell.exe Token: SeRestorePrivilege 2004 powershell.exe Token: SeShutdownPrivilege 2004 powershell.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeSystemEnvironmentPrivilege 2004 powershell.exe Token: SeRemoteShutdownPrivilege 2004 powershell.exe Token: SeUndockPrivilege 2004 powershell.exe Token: SeManageVolumePrivilege 2004 powershell.exe Token: 33 2004 powershell.exe Token: 34 2004 powershell.exe Token: 35 2004 powershell.exe Token: 36 2004 powershell.exe Token: SeIncreaseQuotaPrivilege 2004 powershell.exe Token: SeSecurityPrivilege 2004 powershell.exe Token: SeTakeOwnershipPrivilege 2004 powershell.exe Token: SeLoadDriverPrivilege 2004 powershell.exe Token: SeSystemProfilePrivilege 2004 powershell.exe Token: SeSystemtimePrivilege 2004 powershell.exe Token: SeProfSingleProcessPrivilege 2004 powershell.exe Token: SeIncBasePriorityPrivilege 2004 powershell.exe Token: SeCreatePagefilePrivilege 2004 powershell.exe Token: SeBackupPrivilege 2004 powershell.exe Token: SeRestorePrivilege 2004 powershell.exe Token: SeShutdownPrivilege 2004 powershell.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeSystemEnvironmentPrivilege 2004 powershell.exe Token: SeRemoteShutdownPrivilege 2004 powershell.exe Token: SeUndockPrivilege 2004 powershell.exe Token: SeManageVolumePrivilege 2004 powershell.exe Token: 33 2004 powershell.exe Token: 34 2004 powershell.exe Token: 35 2004 powershell.exe Token: 36 2004 powershell.exe Token: SeIncreaseQuotaPrivilege 2004 powershell.exe Token: SeSecurityPrivilege 2004 powershell.exe Token: SeTakeOwnershipPrivilege 2004 powershell.exe Token: SeLoadDriverPrivilege 2004 powershell.exe Token: SeSystemProfilePrivilege 2004 powershell.exe Token: SeSystemtimePrivilege 2004 powershell.exe Token: SeProfSingleProcessPrivilege 2004 powershell.exe Token: SeIncBasePriorityPrivilege 2004 powershell.exe Token: SeCreatePagefilePrivilege 2004 powershell.exe Token: SeBackupPrivilege 2004 powershell.exe Token: SeRestorePrivilege 2004 powershell.exe Token: SeShutdownPrivilege 2004 powershell.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeSystemEnvironmentPrivilege 2004 powershell.exe Token: SeRemoteShutdownPrivilege 2004 powershell.exe Token: SeUndockPrivilege 2004 powershell.exe Token: SeManageVolumePrivilege 2004 powershell.exe Token: 33 2004 powershell.exe Token: 34 2004 powershell.exe Token: 35 2004 powershell.exe Token: 36 2004 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 1820 wrote to memory of 1264 1820 wscript.EXE 99 PID 1820 wrote to memory of 1264 1820 wscript.EXE 99 PID 1264 wrote to memory of 2004 1264 cscript.exe 101 PID 1264 wrote to memory of 2004 1264 cscript.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\collective bargaining agreement public service canada 75476.js"1⤵PID:4856
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE EQUIPM~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "EQUIPM~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
47.3MB
MD590fed000b07a501b872d18130384fae7
SHA18a06ed0ed209c0586b848d5fc32e1acc8b4839d8
SHA256feb0bacd8361d575dc2b9ff20e70e413373799ba60e5f2e3dae0a43f61142dd7
SHA512714f7785e4e3cfdc476a7f214786936d9cc7030ad43444e7776f81c8d8c8c59e445703646f044382ee9ba448c1e48091dd6d7bfdfc2d955d09f12101680e5d63