Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2024 19:17
Static task
static1
Behavioral task
behavioral1
Sample
Agreement_between_husband_and_wife_sample_98157.zip.7z
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
Agreement_between_husband_and_wife_sample_98157.zip.7z
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Agreement_between_husband_and_wife_sample_98157.zip
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
Agreement_between_husband_and_wife_sample_98157.zip
Resource
win10v2004-20240730-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
agreement between husband and wife sample 5217.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
agreement between husband and wife sample 5217.js
Resource
win10v2004-20240730-en
windows10-2004-x64
General
-
Target
agreement between husband and wife sample 5217.js
-
Size
20.5MB
-
MD5
ec0f178a649479022efd92b114f24f95
-
SHA1
7b18b2fc85fb949af3f4b372bd5b5e2fe1d8ddbf
-
SHA256
a4502a98e81027437e18f559775fcb89b2400f1c026409261290a00532c354a7
-
SHA512
35c16eaca7de7c4d6550e9b3612170671453ee502a55e78d60927846c6afb091546ec9f865e589970565d90cbd7f037f37332ceed32243bdabf70bfca8596806
-
SSDEEP
49152:YYRxr8uC0NjaCX3lgYRxr8uC0NjaCX3lgYRxr8uC0NjaCX3lf:x//J
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 32 1388 powershell.exe 41 1388 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exepid Process 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe 1388 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 1388 powershell.exe Token: SeIncreaseQuotaPrivilege 1388 powershell.exe Token: SeSecurityPrivilege 1388 powershell.exe Token: SeTakeOwnershipPrivilege 1388 powershell.exe Token: SeLoadDriverPrivilege 1388 powershell.exe Token: SeSystemProfilePrivilege 1388 powershell.exe Token: SeSystemtimePrivilege 1388 powershell.exe Token: SeProfSingleProcessPrivilege 1388 powershell.exe Token: SeIncBasePriorityPrivilege 1388 powershell.exe Token: SeCreatePagefilePrivilege 1388 powershell.exe Token: SeBackupPrivilege 1388 powershell.exe Token: SeRestorePrivilege 1388 powershell.exe Token: SeShutdownPrivilege 1388 powershell.exe Token: SeDebugPrivilege 1388 powershell.exe Token: SeSystemEnvironmentPrivilege 1388 powershell.exe Token: SeRemoteShutdownPrivilege 1388 powershell.exe Token: SeUndockPrivilege 1388 powershell.exe Token: SeManageVolumePrivilege 1388 powershell.exe Token: 33 1388 powershell.exe Token: 34 1388 powershell.exe Token: 35 1388 powershell.exe Token: 36 1388 powershell.exe Token: SeIncreaseQuotaPrivilege 1388 powershell.exe Token: SeSecurityPrivilege 1388 powershell.exe Token: SeTakeOwnershipPrivilege 1388 powershell.exe Token: SeLoadDriverPrivilege 1388 powershell.exe Token: SeSystemProfilePrivilege 1388 powershell.exe Token: SeSystemtimePrivilege 1388 powershell.exe Token: SeProfSingleProcessPrivilege 1388 powershell.exe Token: SeIncBasePriorityPrivilege 1388 powershell.exe Token: SeCreatePagefilePrivilege 1388 powershell.exe Token: SeBackupPrivilege 1388 powershell.exe Token: SeRestorePrivilege 1388 powershell.exe Token: SeShutdownPrivilege 1388 powershell.exe Token: SeDebugPrivilege 1388 powershell.exe Token: SeSystemEnvironmentPrivilege 1388 powershell.exe Token: SeRemoteShutdownPrivilege 1388 powershell.exe Token: SeUndockPrivilege 1388 powershell.exe Token: SeManageVolumePrivilege 1388 powershell.exe Token: 33 1388 powershell.exe Token: 34 1388 powershell.exe Token: 35 1388 powershell.exe Token: 36 1388 powershell.exe Token: SeIncreaseQuotaPrivilege 1388 powershell.exe Token: SeSecurityPrivilege 1388 powershell.exe Token: SeTakeOwnershipPrivilege 1388 powershell.exe Token: SeLoadDriverPrivilege 1388 powershell.exe Token: SeSystemProfilePrivilege 1388 powershell.exe Token: SeSystemtimePrivilege 1388 powershell.exe Token: SeProfSingleProcessPrivilege 1388 powershell.exe Token: SeIncBasePriorityPrivilege 1388 powershell.exe Token: SeCreatePagefilePrivilege 1388 powershell.exe Token: SeBackupPrivilege 1388 powershell.exe Token: SeRestorePrivilege 1388 powershell.exe Token: SeShutdownPrivilege 1388 powershell.exe Token: SeDebugPrivilege 1388 powershell.exe Token: SeSystemEnvironmentPrivilege 1388 powershell.exe Token: SeRemoteShutdownPrivilege 1388 powershell.exe Token: SeUndockPrivilege 1388 powershell.exe Token: SeManageVolumePrivilege 1388 powershell.exe Token: 33 1388 powershell.exe Token: 34 1388 powershell.exe Token: 35 1388 powershell.exe Token: 36 1388 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 5020 wrote to memory of 524 5020 wscript.EXE 91 PID 5020 wrote to memory of 524 5020 wscript.EXE 91 PID 524 wrote to memory of 1388 524 cscript.exe 93 PID 524 wrote to memory of 1388 524 cscript.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\agreement between husband and wife sample 5217.js"1⤵PID:3980
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE TORONT~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "TORONT~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39.9MB
MD50ab8b2bdb58f6204386b0dc78cbbb56c
SHA16d03c343dd2a9464ced9680aa763914ab6fcffd3
SHA256161c81e3edaa8ed3b532127194346dc410ae6a28a5e93dda25109543a6bc8dfb
SHA512e773784cab26637622de6316d53a5fe1bacbda70f889920f556f3084e5b3bd8ada8ea3e7163791cadc3c125244460d3f811909e7c9ce574fb9d5a798c2bc34a3