Analysis
-
max time kernel
282s -
max time network
285s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
union_of_taxation_employees_collective_agreement(5036).js
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
union_of_taxation_employees_collective_agreement(5036).js
-
Size
8.0MB
-
MD5
61e1cf211d8b45d8c81d82cf730cdb57
-
SHA1
3af236d430c30909e51e13adba9324f2fc6eeffe
-
SHA256
40bf11617f4a9a957f7d8fab92e381ddb7c40b51f2f2004764a7a8eaf58ac376
-
SHA512
30c43011dbbd15b7051b09eea6581cc20195bc5d1bd8d14df536cab1d9502b470b0f03dd0ccefac709561b68a8b10f005e768fddac6292db18ea37ae87908d11
-
SSDEEP
49152:ghWsnL6rw7cWA/G/s+LfHQlhWsnL6rw7cWA/G/s+LfHQlhWsnL6rw7cWA/G/s+Lk:gcccccT
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 13 IoCs
Processes:
powershell.exeflow pid Process 37 3544 powershell.exe 44 3544 powershell.exe 46 3544 powershell.exe 50 3544 powershell.exe 53 3544 powershell.exe 56 3544 powershell.exe 57 3544 powershell.exe 59 3544 powershell.exe 60 3544 powershell.exe 62 3544 powershell.exe 64 3544 powershell.exe 65 3544 powershell.exe 67 3544 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exepid Process 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 3544 powershell.exe Token: SeIncreaseQuotaPrivilege 3544 powershell.exe Token: SeSecurityPrivilege 3544 powershell.exe Token: SeTakeOwnershipPrivilege 3544 powershell.exe Token: SeLoadDriverPrivilege 3544 powershell.exe Token: SeSystemProfilePrivilege 3544 powershell.exe Token: SeSystemtimePrivilege 3544 powershell.exe Token: SeProfSingleProcessPrivilege 3544 powershell.exe Token: SeIncBasePriorityPrivilege 3544 powershell.exe Token: SeCreatePagefilePrivilege 3544 powershell.exe Token: SeBackupPrivilege 3544 powershell.exe Token: SeRestorePrivilege 3544 powershell.exe Token: SeShutdownPrivilege 3544 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeSystemEnvironmentPrivilege 3544 powershell.exe Token: SeRemoteShutdownPrivilege 3544 powershell.exe Token: SeUndockPrivilege 3544 powershell.exe Token: SeManageVolumePrivilege 3544 powershell.exe Token: 33 3544 powershell.exe Token: 34 3544 powershell.exe Token: 35 3544 powershell.exe Token: 36 3544 powershell.exe Token: SeIncreaseQuotaPrivilege 3544 powershell.exe Token: SeSecurityPrivilege 3544 powershell.exe Token: SeTakeOwnershipPrivilege 3544 powershell.exe Token: SeLoadDriverPrivilege 3544 powershell.exe Token: SeSystemProfilePrivilege 3544 powershell.exe Token: SeSystemtimePrivilege 3544 powershell.exe Token: SeProfSingleProcessPrivilege 3544 powershell.exe Token: SeIncBasePriorityPrivilege 3544 powershell.exe Token: SeCreatePagefilePrivilege 3544 powershell.exe Token: SeBackupPrivilege 3544 powershell.exe Token: SeRestorePrivilege 3544 powershell.exe Token: SeShutdownPrivilege 3544 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeSystemEnvironmentPrivilege 3544 powershell.exe Token: SeRemoteShutdownPrivilege 3544 powershell.exe Token: SeUndockPrivilege 3544 powershell.exe Token: SeManageVolumePrivilege 3544 powershell.exe Token: 33 3544 powershell.exe Token: 34 3544 powershell.exe Token: 35 3544 powershell.exe Token: 36 3544 powershell.exe Token: SeIncreaseQuotaPrivilege 3544 powershell.exe Token: SeSecurityPrivilege 3544 powershell.exe Token: SeTakeOwnershipPrivilege 3544 powershell.exe Token: SeLoadDriverPrivilege 3544 powershell.exe Token: SeSystemProfilePrivilege 3544 powershell.exe Token: SeSystemtimePrivilege 3544 powershell.exe Token: SeProfSingleProcessPrivilege 3544 powershell.exe Token: SeIncBasePriorityPrivilege 3544 powershell.exe Token: SeCreatePagefilePrivilege 3544 powershell.exe Token: SeBackupPrivilege 3544 powershell.exe Token: SeRestorePrivilege 3544 powershell.exe Token: SeShutdownPrivilege 3544 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeSystemEnvironmentPrivilege 3544 powershell.exe Token: SeRemoteShutdownPrivilege 3544 powershell.exe Token: SeUndockPrivilege 3544 powershell.exe Token: SeManageVolumePrivilege 3544 powershell.exe Token: 33 3544 powershell.exe Token: 34 3544 powershell.exe Token: 35 3544 powershell.exe Token: 36 3544 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 1776 wrote to memory of 4644 1776 wscript.EXE 96 PID 1776 wrote to memory of 4644 1776 wscript.EXE 96 PID 4644 wrote to memory of 3544 4644 cscript.exe 98 PID 4644 wrote to memory of 3544 4644 cscript.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\union_of_taxation_employees_collective_agreement(5036).js1⤵PID:4784
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE SERVES~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "SERVES~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
41.8MB
MD5fa8ffa4c327f973bb4fd84fa9a264058
SHA1b83cda69a055069a379455b9be750ff2b8a59e27
SHA25610834c92343679d4329cf9b00a1ae52882e8a846973e43765c8a266b4b80eba2
SHA512bf3fe4a0bbb3511505b26416c56a2bb29f05b61e2b4d46da17b19ea8282f483284e38614e7659a6753f2d1f6384eeab59137f211a3ed7dfb6f55bb104cdd612a