gootloader | 7ea81a28236a0f5ec3646974c3a918e650d5731e6be7a04cac1b80d08d2be1e4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ea81a28236a0f5ec3646974c3a918e650d5731e6be7a04cac1b80d08d2be1e4.js
Size

17.3MB
MD5

cde17880d76697c461089443462fc29c
SHA1

c776f53023a73b1448df8e0b3f04797a74df0c5d
SHA256

7ea81a28236a0f5ec3646974c3a918e650d5731e6be7a04cac1b80d08d2be1e4
SHA512

eb1263a1c9426abb71ff789e5abe095dcf62cb893e7718b4fbc9585ca6a344a713d8e70c08c27a8c1492d50bca87ed4725d14c8194aa1160231223eaa9eca2bb
SSDEEP

49152:SPcM+UtFbEc6GhQX5CCl+4SSNRLFjzW03NZPn3SbYmGBl+Kn8P4BlwUC3kiQijsg:n3232323232323K

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
1264	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	1264	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	Process	procid_target
PID 2820 wrote to memory of 2972	2820	taskeng.exe	32
PID 2820 wrote to memory of 2972	2820	taskeng.exe	32
PID 2820 wrote to memory of 2972	2820	taskeng.exe	32
PID 2972 wrote to memory of 2584	2972	wscript.EXE	33
PID 2972 wrote to memory of 2584	2972	wscript.EXE	33
PID 2972 wrote to memory of 2584	2972	wscript.EXE	33
PID 2584 wrote to memory of 1264	2584	cscript.exe	35
PID 2584 wrote to memory of 1264	2584	cscript.exe	35
PID 2584 wrote to memory of 1264	2584	cscript.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7ea81a28236a0f5ec3646974c3a918e650d5731e6be7a04cac1b80d08d2be1e4.js
1⤵
PID:1000

C:\Windows\system32\taskeng.exe
taskeng.exe {D288141B-DED5-432B-8C11-761BEEDB6412} S-1-5-21-2958949473-3205530200-1453100116-1000:WHMFPZKA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE WORKPL~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "WORKPL~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\WORKPL~1.JS

Filesize
47.0MB

MD5
653b5d2f4e27e29dcbd4f403bf96429b

SHA1
67606d1a16deca763eb878fc6495e931d32ae347

SHA256
8b91bd58e85639e96f6f716a96915ec3741342713dcc9e36122d1147304557e8

SHA512
3d89e4db8505a6ded7a35b87898a5564c36f777fb270860d8e0b7800c88f36090725b198c7cdd5e7f2b47fa68ed28f2c46bfefd1e7f9209df5c0aebace0e0683

Download Submit
memory/1264-7-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1264-8-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download