Analysis

  • max time kernel
    285s
  • max time network
    287s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-08-2024 12:38

General

  • Target

    government_of_bc_collective_agreement(6869).js

  • Size

    9.9MB

  • MD5

    e126b8b2c40d071b99abbc670d6b1ce7

  • SHA1

    41218971f1c79fab64fc08f1ca7ff8fbb31abe53

  • SHA256

    1979602a4985a955246d865edda201643b5047a288c1d09e73c724e833aca4c5

  • SHA512

    32be2d9db83bd25a21bf2cf389fd555748b220ada4bc19a2d59463be4fc9171c18ef6e0e4d456ae93fc7eaef7eb33e80d6820603b7476032e100a9506604e212

  • SSDEEP

    49152:Zck/+UbFbEc6GhQ25Cql+4SSNRLFjzW03NZPn3SbYmGBl+Kn8P4BlwUC3kiQijsj:53M3M3M3K

Malware Config

Signatures

  • GootLoader

    JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.

  • Blocklisted process makes network request 10 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\government_of_bc_collective_agreement(6869).js
    1⤵
      PID:2064
    • C:\Windows\system32\wscript.EXE
      C:\Windows\system32\wscript.EXE CHANGE~1.JS
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Windows\System32\cscript.exe
        "C:\Windows\System32\cscript.exe" "CHANGE~1.JS"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:224
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell
          3⤵
          • Blocklisted process makes network request
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4436

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eetgyifd.zfz.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\CHANGE~1.JS

      Filesize

      46.0MB

      MD5

      5c4ea67fc438ee849880d351534b7e00

      SHA1

      969c577002bf40e639e069f047d9bf523e100e67

      SHA256

      bdb7ff12b075dcb554f6a397ccb7e8f286ff45bc93afb4392ffd8d52dcf011c4

      SHA512

      58aa6d0f81971caa26981a28452c0eb568bfd088a5853072e6f9c70a06b58dba7528957106d522f416fd74afe04510f48348fd7dde10c0b4a5083aeddbe6a565

    • memory/4436-3-0x0000012BF1FE0000-0x0000012BF2002000-memory.dmp

      Filesize

      136KB

    • memory/4436-13-0x0000012BF24D0000-0x0000012BF2514000-memory.dmp

      Filesize

      272KB

    • memory/4436-14-0x0000012BF25A0000-0x0000012BF2616000-memory.dmp

      Filesize

      472KB

    • memory/4436-15-0x0000012BF27F0000-0x0000012BF281A000-memory.dmp

      Filesize

      168KB

    • memory/4436-16-0x0000012BF27F0000-0x0000012BF2814000-memory.dmp

      Filesize

      144KB