Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31/07/2024, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
agreement between husband and wife sample 5217.js
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
agreement between husband and wife sample 5217.js
Resource
win10v2004-20240730-en
windows10-2004-x64
General
-
Target
agreement between husband and wife sample 5217.js
-
Size
20.5MB
-
MD5
ec0f178a649479022efd92b114f24f95
-
SHA1
7b18b2fc85fb949af3f4b372bd5b5e2fe1d8ddbf
-
SHA256
a4502a98e81027437e18f559775fcb89b2400f1c026409261290a00532c354a7
-
SHA512
35c16eaca7de7c4d6550e9b3612170671453ee502a55e78d60927846c6afb091546ec9f865e589970565d90cbd7f037f37332ceed32243bdabf70bfca8596806
-
SSDEEP
49152:YYRxr8uC0NjaCX3lgYRxr8uC0NjaCX3lgYRxr8uC0NjaCX3lf:x//J
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 4 IoCs
flow pid Process 37 3784 powershell.exe 46 3784 powershell.exe 49 3784 powershell.exe 51 3784 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3784 powershell.exe Token: SeIncreaseQuotaPrivilege 3784 powershell.exe Token: SeSecurityPrivilege 3784 powershell.exe Token: SeTakeOwnershipPrivilege 3784 powershell.exe Token: SeLoadDriverPrivilege 3784 powershell.exe Token: SeSystemProfilePrivilege 3784 powershell.exe Token: SeSystemtimePrivilege 3784 powershell.exe Token: SeProfSingleProcessPrivilege 3784 powershell.exe Token: SeIncBasePriorityPrivilege 3784 powershell.exe Token: SeCreatePagefilePrivilege 3784 powershell.exe Token: SeBackupPrivilege 3784 powershell.exe Token: SeRestorePrivilege 3784 powershell.exe Token: SeShutdownPrivilege 3784 powershell.exe Token: SeDebugPrivilege 3784 powershell.exe Token: SeSystemEnvironmentPrivilege 3784 powershell.exe Token: SeRemoteShutdownPrivilege 3784 powershell.exe Token: SeUndockPrivilege 3784 powershell.exe Token: SeManageVolumePrivilege 3784 powershell.exe Token: 33 3784 powershell.exe Token: 34 3784 powershell.exe Token: 35 3784 powershell.exe Token: 36 3784 powershell.exe Token: SeIncreaseQuotaPrivilege 3784 powershell.exe Token: SeSecurityPrivilege 3784 powershell.exe Token: SeTakeOwnershipPrivilege 3784 powershell.exe Token: SeLoadDriverPrivilege 3784 powershell.exe Token: SeSystemProfilePrivilege 3784 powershell.exe Token: SeSystemtimePrivilege 3784 powershell.exe Token: SeProfSingleProcessPrivilege 3784 powershell.exe Token: SeIncBasePriorityPrivilege 3784 powershell.exe Token: SeCreatePagefilePrivilege 3784 powershell.exe Token: SeBackupPrivilege 3784 powershell.exe Token: SeRestorePrivilege 3784 powershell.exe Token: SeShutdownPrivilege 3784 powershell.exe Token: SeDebugPrivilege 3784 powershell.exe Token: SeSystemEnvironmentPrivilege 3784 powershell.exe Token: SeRemoteShutdownPrivilege 3784 powershell.exe Token: SeUndockPrivilege 3784 powershell.exe Token: SeManageVolumePrivilege 3784 powershell.exe Token: 33 3784 powershell.exe Token: 34 3784 powershell.exe Token: 35 3784 powershell.exe Token: 36 3784 powershell.exe Token: SeIncreaseQuotaPrivilege 3784 powershell.exe Token: SeSecurityPrivilege 3784 powershell.exe Token: SeTakeOwnershipPrivilege 3784 powershell.exe Token: SeLoadDriverPrivilege 3784 powershell.exe Token: SeSystemProfilePrivilege 3784 powershell.exe Token: SeSystemtimePrivilege 3784 powershell.exe Token: SeProfSingleProcessPrivilege 3784 powershell.exe Token: SeIncBasePriorityPrivilege 3784 powershell.exe Token: SeCreatePagefilePrivilege 3784 powershell.exe Token: SeBackupPrivilege 3784 powershell.exe Token: SeRestorePrivilege 3784 powershell.exe Token: SeShutdownPrivilege 3784 powershell.exe Token: SeDebugPrivilege 3784 powershell.exe Token: SeSystemEnvironmentPrivilege 3784 powershell.exe Token: SeRemoteShutdownPrivilege 3784 powershell.exe Token: SeUndockPrivilege 3784 powershell.exe Token: SeManageVolumePrivilege 3784 powershell.exe Token: 33 3784 powershell.exe Token: 34 3784 powershell.exe Token: 35 3784 powershell.exe Token: 36 3784 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1616 wrote to memory of 4872 1616 wscript.EXE 90 PID 1616 wrote to memory of 4872 1616 wscript.EXE 90 PID 4872 wrote to memory of 3784 4872 cscript.exe 96 PID 4872 wrote to memory of 3784 4872 cscript.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\agreement between husband and wife sample 5217.js"1⤵PID:3716
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE TORONT~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "TORONT~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39.9MB
MD50ab8b2bdb58f6204386b0dc78cbbb56c
SHA16d03c343dd2a9464ced9680aa763914ab6fcffd3
SHA256161c81e3edaa8ed3b532127194346dc410ae6a28a5e93dda25109543a6bc8dfb
SHA512e773784cab26637622de6316d53a5fe1bacbda70f889920f556f3084e5b3bd8ada8ea3e7163791cadc3c125244460d3f811909e7c9ce574fb9d5a798c2bc34a3