Analysis
-
max time kernel
138s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2024 15:42
Static task
static1
Behavioral task
behavioral1
Sample
1771f94e898e28e8d9e6eac9ff8fa457ca17948d4599890915b833e71106982c.js
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
1771f94e898e28e8d9e6eac9ff8fa457ca17948d4599890915b833e71106982c.js
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
1771f94e898e28e8d9e6eac9ff8fa457ca17948d4599890915b833e71106982c.js
-
Size
5.3MB
-
MD5
c34769845b3c81530e785a2539d55ad9
-
SHA1
f429bbe44bc3c633b7675175708c76093003feff
-
SHA256
1771f94e898e28e8d9e6eac9ff8fa457ca17948d4599890915b833e71106982c
-
SHA512
c1d9a7db007e82d8ff2a60be97b1096e28beec1fbed847db0d4656b447441d4317d32159261a4eaf53022702c81256a4adb79c6fce50a82b9b88c15ee14a4ace
-
SSDEEP
49152:tWR+nGElwTrd6gG/s+LfHQ0WR+nGElwTrd6gG/s+LfHQ0WR+nGElwTrd6gG/s+Lr:trrr9
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid Process 53 4996 powershell.exe 71 4996 powershell.exe 73 4996 powershell.exe 75 4996 powershell.exe 76 4996 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepid Process 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 4996 powershell.exe Token: SeIncreaseQuotaPrivilege 4996 powershell.exe Token: SeSecurityPrivilege 4996 powershell.exe Token: SeTakeOwnershipPrivilege 4996 powershell.exe Token: SeLoadDriverPrivilege 4996 powershell.exe Token: SeSystemProfilePrivilege 4996 powershell.exe Token: SeSystemtimePrivilege 4996 powershell.exe Token: SeProfSingleProcessPrivilege 4996 powershell.exe Token: SeIncBasePriorityPrivilege 4996 powershell.exe Token: SeCreatePagefilePrivilege 4996 powershell.exe Token: SeBackupPrivilege 4996 powershell.exe Token: SeRestorePrivilege 4996 powershell.exe Token: SeShutdownPrivilege 4996 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeSystemEnvironmentPrivilege 4996 powershell.exe Token: SeRemoteShutdownPrivilege 4996 powershell.exe Token: SeUndockPrivilege 4996 powershell.exe Token: SeManageVolumePrivilege 4996 powershell.exe Token: 33 4996 powershell.exe Token: 34 4996 powershell.exe Token: 35 4996 powershell.exe Token: 36 4996 powershell.exe Token: SeIncreaseQuotaPrivilege 4996 powershell.exe Token: SeSecurityPrivilege 4996 powershell.exe Token: SeTakeOwnershipPrivilege 4996 powershell.exe Token: SeLoadDriverPrivilege 4996 powershell.exe Token: SeSystemProfilePrivilege 4996 powershell.exe Token: SeSystemtimePrivilege 4996 powershell.exe Token: SeProfSingleProcessPrivilege 4996 powershell.exe Token: SeIncBasePriorityPrivilege 4996 powershell.exe Token: SeCreatePagefilePrivilege 4996 powershell.exe Token: SeBackupPrivilege 4996 powershell.exe Token: SeRestorePrivilege 4996 powershell.exe Token: SeShutdownPrivilege 4996 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeSystemEnvironmentPrivilege 4996 powershell.exe Token: SeRemoteShutdownPrivilege 4996 powershell.exe Token: SeUndockPrivilege 4996 powershell.exe Token: SeManageVolumePrivilege 4996 powershell.exe Token: 33 4996 powershell.exe Token: 34 4996 powershell.exe Token: 35 4996 powershell.exe Token: 36 4996 powershell.exe Token: SeIncreaseQuotaPrivilege 4996 powershell.exe Token: SeSecurityPrivilege 4996 powershell.exe Token: SeTakeOwnershipPrivilege 4996 powershell.exe Token: SeLoadDriverPrivilege 4996 powershell.exe Token: SeSystemProfilePrivilege 4996 powershell.exe Token: SeSystemtimePrivilege 4996 powershell.exe Token: SeProfSingleProcessPrivilege 4996 powershell.exe Token: SeIncBasePriorityPrivilege 4996 powershell.exe Token: SeCreatePagefilePrivilege 4996 powershell.exe Token: SeBackupPrivilege 4996 powershell.exe Token: SeRestorePrivilege 4996 powershell.exe Token: SeShutdownPrivilege 4996 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeSystemEnvironmentPrivilege 4996 powershell.exe Token: SeRemoteShutdownPrivilege 4996 powershell.exe Token: SeUndockPrivilege 4996 powershell.exe Token: SeManageVolumePrivilege 4996 powershell.exe Token: 33 4996 powershell.exe Token: 34 4996 powershell.exe Token: 35 4996 powershell.exe Token: 36 4996 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 3200 wrote to memory of 1748 3200 wscript.EXE 99 PID 3200 wrote to memory of 1748 3200 wscript.EXE 99 PID 1748 wrote to memory of 4996 1748 cscript.exe 101 PID 1748 wrote to memory of 4996 1748 cscript.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\1771f94e898e28e8d9e6eac9ff8fa457ca17948d4599890915b833e71106982c.js1⤵PID:964
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE VIRTUA~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "VIRTUA~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
45.7MB
MD5fa33856cdd141858ba2ac178f7fa578e
SHA1f1679423b57a78d29e7a46962a89e08f29db0f55
SHA25683c748a7477453552193038657cd29fbc47cea50cb77ec52767ee7091f7af6f8
SHA51297a728ce3576bec8512e069d150a75695450176443243655b62b126abdbeace6bfe93979959d150f82362c375f3e688543cc29f2ad4ed6fb3c1bdf679fcf710f