Analysis
-
max time kernel
285s -
max time network
287s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 12:38
Static task
static1
Behavioral task
behavioral1
Sample
government_of_bc_collective_agreement(6869).js
Resource
win10v2004-20240802-en
General
-
Target
government_of_bc_collective_agreement(6869).js
-
Size
9.9MB
-
MD5
e126b8b2c40d071b99abbc670d6b1ce7
-
SHA1
41218971f1c79fab64fc08f1ca7ff8fbb31abe53
-
SHA256
1979602a4985a955246d865edda201643b5047a288c1d09e73c724e833aca4c5
-
SHA512
32be2d9db83bd25a21bf2cf389fd555748b220ada4bc19a2d59463be4fc9171c18ef6e0e4d456ae93fc7eaef7eb33e80d6820603b7476032e100a9506604e212
-
SSDEEP
49152:Zck/+UbFbEc6GhQ25Cql+4SSNRLFjzW03NZPn3SbYmGBl+Kn8P4BlwUC3kiQijsj:53M3M3M3K
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 10 IoCs
Processes:
powershell.exeflow pid Process 50 4436 powershell.exe 67 4436 powershell.exe 70 4436 powershell.exe 74 4436 powershell.exe 76 4436 powershell.exe 78 4436 powershell.exe 80 4436 powershell.exe 81 4436 powershell.exe 83 4436 powershell.exe 86 4436 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exepid Process 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe 4436 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 4436 powershell.exe Token: SeIncreaseQuotaPrivilege 4436 powershell.exe Token: SeSecurityPrivilege 4436 powershell.exe Token: SeTakeOwnershipPrivilege 4436 powershell.exe Token: SeLoadDriverPrivilege 4436 powershell.exe Token: SeSystemProfilePrivilege 4436 powershell.exe Token: SeSystemtimePrivilege 4436 powershell.exe Token: SeProfSingleProcessPrivilege 4436 powershell.exe Token: SeIncBasePriorityPrivilege 4436 powershell.exe Token: SeCreatePagefilePrivilege 4436 powershell.exe Token: SeBackupPrivilege 4436 powershell.exe Token: SeRestorePrivilege 4436 powershell.exe Token: SeShutdownPrivilege 4436 powershell.exe Token: SeDebugPrivilege 4436 powershell.exe Token: SeSystemEnvironmentPrivilege 4436 powershell.exe Token: SeRemoteShutdownPrivilege 4436 powershell.exe Token: SeUndockPrivilege 4436 powershell.exe Token: SeManageVolumePrivilege 4436 powershell.exe Token: 33 4436 powershell.exe Token: 34 4436 powershell.exe Token: 35 4436 powershell.exe Token: 36 4436 powershell.exe Token: SeIncreaseQuotaPrivilege 4436 powershell.exe Token: SeSecurityPrivilege 4436 powershell.exe Token: SeTakeOwnershipPrivilege 4436 powershell.exe Token: SeLoadDriverPrivilege 4436 powershell.exe Token: SeSystemProfilePrivilege 4436 powershell.exe Token: SeSystemtimePrivilege 4436 powershell.exe Token: SeProfSingleProcessPrivilege 4436 powershell.exe Token: SeIncBasePriorityPrivilege 4436 powershell.exe Token: SeCreatePagefilePrivilege 4436 powershell.exe Token: SeBackupPrivilege 4436 powershell.exe Token: SeRestorePrivilege 4436 powershell.exe Token: SeShutdownPrivilege 4436 powershell.exe Token: SeDebugPrivilege 4436 powershell.exe Token: SeSystemEnvironmentPrivilege 4436 powershell.exe Token: SeRemoteShutdownPrivilege 4436 powershell.exe Token: SeUndockPrivilege 4436 powershell.exe Token: SeManageVolumePrivilege 4436 powershell.exe Token: 33 4436 powershell.exe Token: 34 4436 powershell.exe Token: 35 4436 powershell.exe Token: 36 4436 powershell.exe Token: SeIncreaseQuotaPrivilege 4436 powershell.exe Token: SeSecurityPrivilege 4436 powershell.exe Token: SeTakeOwnershipPrivilege 4436 powershell.exe Token: SeLoadDriverPrivilege 4436 powershell.exe Token: SeSystemProfilePrivilege 4436 powershell.exe Token: SeSystemtimePrivilege 4436 powershell.exe Token: SeProfSingleProcessPrivilege 4436 powershell.exe Token: SeIncBasePriorityPrivilege 4436 powershell.exe Token: SeCreatePagefilePrivilege 4436 powershell.exe Token: SeBackupPrivilege 4436 powershell.exe Token: SeRestorePrivilege 4436 powershell.exe Token: SeShutdownPrivilege 4436 powershell.exe Token: SeDebugPrivilege 4436 powershell.exe Token: SeSystemEnvironmentPrivilege 4436 powershell.exe Token: SeRemoteShutdownPrivilege 4436 powershell.exe Token: SeUndockPrivilege 4436 powershell.exe Token: SeManageVolumePrivilege 4436 powershell.exe Token: 33 4436 powershell.exe Token: 34 4436 powershell.exe Token: 35 4436 powershell.exe Token: 36 4436 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 228 wrote to memory of 224 228 wscript.EXE 100 PID 228 wrote to memory of 224 228 wscript.EXE 100 PID 224 wrote to memory of 4436 224 cscript.exe 102 PID 224 wrote to memory of 4436 224 cscript.exe 102 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\government_of_bc_collective_agreement(6869).js1⤵PID:2064
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE CHANGE~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "CHANGE~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
46.0MB
MD55c4ea67fc438ee849880d351534b7e00
SHA1969c577002bf40e639e069f047d9bf523e100e67
SHA256bdb7ff12b075dcb554f6a397ccb7e8f286ff45bc93afb4392ffd8d52dcf011c4
SHA51258aa6d0f81971caa26981a28452c0eb568bfd088a5853072e6f9c70a06b58dba7528957106d522f416fd74afe04510f48348fd7dde10c0b4a5083aeddbe6a565