gootloader | 3542cff26dff552c2c507753a6d951c9640fe1232b3f6b2620134f69e125a67f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3542cff26dff552c2c507753a6d951c9640fe1232b3f6b2620134f69e125a67f.js
Size

127KB
MD5

962962ae15b4228c0276ce03f5faa080
SHA1

797d161b7910cf267a9d351b08a000046b80cebc
SHA256

3542cff26dff552c2c507753a6d951c9640fe1232b3f6b2620134f69e125a67f
SHA512

7cf38f15bd11d04acd96f2b608760aa242bd874b392da758fa109ceb5f3abc221e88b9a508469d48c44f2f2a3b89ebdde8b77e769908d94b446c24ce3432b53a
SSDEEP

1536:abi/0H88HqHOdVu6Kh6PwuQDZ3zWrCEij97Mjs7q3bBptF+i3F0+jDE5PaRT4MwP:abBHPKHMQhgcqbBptF+iwPaRT4vRLJSI

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

poWErshEll.exe

pid	Process
1468	poWErshEll.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

poWErshEll.exe

description	pid	Process
Token: SeDebugPrivilege	1468	poWErshEll.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	Process	procid_target
PID 2760 wrote to memory of 2896	2760	taskeng.exe	32
PID 2760 wrote to memory of 2896	2760	taskeng.exe	32
PID 2760 wrote to memory of 2896	2760	taskeng.exe	32
PID 2896 wrote to memory of 2664	2896	wscript.EXE	33
PID 2896 wrote to memory of 2664	2896	wscript.EXE	33
PID 2896 wrote to memory of 2664	2896	wscript.EXE	33
PID 2664 wrote to memory of 1468	2664	cscript.exe	35
PID 2664 wrote to memory of 1468	2664	cscript.exe	35
PID 2664 wrote to memory of 1468	2664	cscript.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3542cff26dff552c2c507753a6d951c9640fe1232b3f6b2620134f69e125a67f.js
1⤵
PID:2348

C:\Windows\system32\taskeng.exe
taskeng.exe {2567EF8D-0EBB-45EE-85CE-7B7BC0684EA8} S-1-5-21-2958949473-3205530200-1453100116-1000:WHMFPZKA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE CRYSTA~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "CRYSTA~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\poWErshEll.exe
      poWErshEll
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\CRYSTA~1.JS

Filesize
46.3MB

MD5
99e6d912047af26689056f41a04bbeba

SHA1
f7e1667f784ca0bdfd83de0bcb2c711e7b9f486a

SHA256
b82f4b6465b7b3449c5617f9d80faf805d81224bdc1542b0e861d8ab8acc32df

SHA512
80fe1c29392a8c93bd0724bab04cd418f0b7cc90cc314db6958548ae07c707b37b2e40c10e631a43e3cf7f83dd89f17bd4578f2dc3091584d6c5c4340ab12882

Download Submit
memory/1468-7-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/1468-8-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download