Analysis

  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-08-2024 11:54

General

  • Target

    3542cff26dff552c2c507753a6d951c9640fe1232b3f6b2620134f69e125a67f.js

  • Size

    127KB

  • MD5

    962962ae15b4228c0276ce03f5faa080

  • SHA1

    797d161b7910cf267a9d351b08a000046b80cebc

  • SHA256

    3542cff26dff552c2c507753a6d951c9640fe1232b3f6b2620134f69e125a67f

  • SHA512

    7cf38f15bd11d04acd96f2b608760aa242bd874b392da758fa109ceb5f3abc221e88b9a508469d48c44f2f2a3b89ebdde8b77e769908d94b446c24ce3432b53a

  • SSDEEP

    1536:abi/0H88HqHOdVu6Kh6PwuQDZ3zWrCEij97Mjs7q3bBptF+i3F0+jDE5PaRT4MwP:abBHPKHMQhgcqbBptF+iwPaRT4vRLJSI

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\3542cff26dff552c2c507753a6d951c9640fe1232b3f6b2620134f69e125a67f.js
    1⤵
      PID:3884
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
      1⤵
        PID:4664
      • C:\Windows\system32\wscript.EXE
        C:\Windows\system32\wscript.EXE CRYSTA~1.JS
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:452
        • C:\Windows\System32\cscript.exe
          "C:\Windows\System32\cscript.exe" "CRYSTA~1.JS"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:736
          • C:\Windows\System32\WindowsPowerShell\v1.0\poWErshEll.exe
            poWErshEll
            3⤵
            • Blocklisted process makes network request
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1816

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xff4j2t4.yyh.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\Adobe\CRYSTA~1.JS

        Filesize

        46.3MB

        MD5

        cf6756fd093eeef671e90c2a2e966814

        SHA1

        2bdfd19b627b4d3f7d9e642236bd24e84725ee68

        SHA256

        5ce4717ed96e969ad3c93a95a3caae72d35539ee0d527360a7c6afad7462cf18

        SHA512

        e3b0abe9934ad7e6680a9a2f7ba2aee62b4d1945a4f5c9da691a0ee5a1f7fa03b0d901390a221ee32a0eb31d09e8048097f60a8009b493a1a16a6f9d2bb73946

      • memory/1816-3-0x0000024673990000-0x00000246739B2000-memory.dmp

        Filesize

        136KB

      • memory/1816-13-0x0000024673B10000-0x0000024673B54000-memory.dmp

        Filesize

        272KB

      • memory/1816-14-0x0000024673FA0000-0x0000024674016000-memory.dmp

        Filesize

        472KB

      • memory/1816-15-0x00000246741B0000-0x00000246741DA000-memory.dmp

        Filesize

        168KB

      • memory/1816-16-0x00000246741B0000-0x00000246741D4000-memory.dmp

        Filesize

        144KB