Resubmissions

21-08-2024 17:41

240821-v9p51avgmr 10

21-08-2024 12:16

240821-pfwg2a1ern 10

Analysis

  • max time kernel
    359s
  • max time network
    361s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21-08-2024 17:41

General

  • Target

    government_of_bc_collective_agreement(14085).js

  • Size

    7.4MB

  • MD5

    d29afe6b00c5bfc82c1adb11b0808ecd

  • SHA1

    fcea0e87641b47c22f6129d98e012cd6d7ad962a

  • SHA256

    579f27bb326b7eea45ad12844d68323c75ec860ca8c43c388aeab7cb338f20af

  • SHA512

    8ba47f1f4cdb4c54071bbc2b6193412e44a1157e796a33d87e9752660de1ff977a876c11694f573a55f327d7a69f4f62adc7353c0f3314d6f7a89d0ab7a803f0

  • SSDEEP

    49152:pxja+NvsFbEc6GhQz5Czl+4SSNRLFjzW03NZPn3SbYmGBl+Kn8P4BlwUC3kiQijn:ZG30G30G3K

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\government_of_bc_collective_agreement(14085).js
    1⤵
      PID:2860
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {2612F171-E762-4831-8729-35983C287F49} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\system32\wscript.EXE
        C:\Windows\system32\wscript.EXE PROFES~1.JS
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\System32\cscript.exe
          "C:\Windows\System32\cscript.exe" "PROFES~1.JS"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:856
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2904

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\PROFES~1.JS

      Filesize

      38.4MB

      MD5

      fa13a93a88b5389a3b6c194e98b4de27

      SHA1

      31b621a6907c23f221038273394ac05882e028dc

      SHA256

      db4833fcc45a5091bba755e88cd950023c2caf8a6c6b649c2b1437e131e959ba

      SHA512

      9705a7e38e0934de70a3c4f3d1c53d8f0c3b103ed40389d58da75652a21d33f8a6d2ee4e9f8aeefff2a9eebccce14a3729632231c313d1227d466059e95ae74d

    • memory/2904-7-0x000000001B800000-0x000000001BAE2000-memory.dmp

      Filesize

      2.9MB

    • memory/2904-8-0x0000000001E60000-0x0000000001E68000-memory.dmp

      Filesize

      32KB