Analysis
-
max time kernel
289s -
max time network
291s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 14:04
Static task
static1
Behavioral task
behavioral1
Sample
union_of_taxation_employees_collective_agreement(221).js
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
union_of_taxation_employees_collective_agreement(221).js
-
Size
10.6MB
-
MD5
1d0bf84687e2a729b33f415e558e7fdb
-
SHA1
cc4e6437fa0a216540b10498c7d5e7c7854b4550
-
SHA256
b72dc2b479a9f8a1a9e55eb6bd21a823d4f5ccefc20e566b3d00fd8811185a7f
-
SHA512
950bd85e04d2be8aab4f68d7cbba73144557bd4a08c7086a8805f01260b19f8ea069ecb9caa15f5dcadd0e4e2b7baf963fa0cfecb6939054750560d168c14391
-
SSDEEP
49152:ZZmKvXnWYiwPNgEHF/s+LfHQeZmKvXnWYiwPNgEHF/s+LfHQeZmKvXnWYiwPNgE1:Z1F1F1F1F1F1F1F1z
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 8 IoCs
Processes:
powershell.exeflow pid Process 48 3388 powershell.exe 57 3388 powershell.exe 60 3388 powershell.exe 63 3388 powershell.exe 65 3388 powershell.exe 66 3388 powershell.exe 69 3388 powershell.exe 71 3388 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepid Process 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 3388 powershell.exe Token: SeIncreaseQuotaPrivilege 3388 powershell.exe Token: SeSecurityPrivilege 3388 powershell.exe Token: SeTakeOwnershipPrivilege 3388 powershell.exe Token: SeLoadDriverPrivilege 3388 powershell.exe Token: SeSystemProfilePrivilege 3388 powershell.exe Token: SeSystemtimePrivilege 3388 powershell.exe Token: SeProfSingleProcessPrivilege 3388 powershell.exe Token: SeIncBasePriorityPrivilege 3388 powershell.exe Token: SeCreatePagefilePrivilege 3388 powershell.exe Token: SeBackupPrivilege 3388 powershell.exe Token: SeRestorePrivilege 3388 powershell.exe Token: SeShutdownPrivilege 3388 powershell.exe Token: SeDebugPrivilege 3388 powershell.exe Token: SeSystemEnvironmentPrivilege 3388 powershell.exe Token: SeRemoteShutdownPrivilege 3388 powershell.exe Token: SeUndockPrivilege 3388 powershell.exe Token: SeManageVolumePrivilege 3388 powershell.exe Token: 33 3388 powershell.exe Token: 34 3388 powershell.exe Token: 35 3388 powershell.exe Token: 36 3388 powershell.exe Token: SeIncreaseQuotaPrivilege 3388 powershell.exe Token: SeSecurityPrivilege 3388 powershell.exe Token: SeTakeOwnershipPrivilege 3388 powershell.exe Token: SeLoadDriverPrivilege 3388 powershell.exe Token: SeSystemProfilePrivilege 3388 powershell.exe Token: SeSystemtimePrivilege 3388 powershell.exe Token: SeProfSingleProcessPrivilege 3388 powershell.exe Token: SeIncBasePriorityPrivilege 3388 powershell.exe Token: SeCreatePagefilePrivilege 3388 powershell.exe Token: SeBackupPrivilege 3388 powershell.exe Token: SeRestorePrivilege 3388 powershell.exe Token: SeShutdownPrivilege 3388 powershell.exe Token: SeDebugPrivilege 3388 powershell.exe Token: SeSystemEnvironmentPrivilege 3388 powershell.exe Token: SeRemoteShutdownPrivilege 3388 powershell.exe Token: SeUndockPrivilege 3388 powershell.exe Token: SeManageVolumePrivilege 3388 powershell.exe Token: 33 3388 powershell.exe Token: 34 3388 powershell.exe Token: 35 3388 powershell.exe Token: 36 3388 powershell.exe Token: SeIncreaseQuotaPrivilege 3388 powershell.exe Token: SeSecurityPrivilege 3388 powershell.exe Token: SeTakeOwnershipPrivilege 3388 powershell.exe Token: SeLoadDriverPrivilege 3388 powershell.exe Token: SeSystemProfilePrivilege 3388 powershell.exe Token: SeSystemtimePrivilege 3388 powershell.exe Token: SeProfSingleProcessPrivilege 3388 powershell.exe Token: SeIncBasePriorityPrivilege 3388 powershell.exe Token: SeCreatePagefilePrivilege 3388 powershell.exe Token: SeBackupPrivilege 3388 powershell.exe Token: SeRestorePrivilege 3388 powershell.exe Token: SeShutdownPrivilege 3388 powershell.exe Token: SeDebugPrivilege 3388 powershell.exe Token: SeSystemEnvironmentPrivilege 3388 powershell.exe Token: SeRemoteShutdownPrivilege 3388 powershell.exe Token: SeUndockPrivilege 3388 powershell.exe Token: SeManageVolumePrivilege 3388 powershell.exe Token: 33 3388 powershell.exe Token: 34 3388 powershell.exe Token: 35 3388 powershell.exe Token: 36 3388 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 2796 wrote to memory of 4188 2796 wscript.EXE 95 PID 2796 wrote to memory of 4188 2796 wscript.EXE 95 PID 4188 wrote to memory of 3388 4188 cscript.exe 98 PID 4188 wrote to memory of 3388 4188 cscript.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\union_of_taxation_employees_collective_agreement(221).js1⤵PID:3316
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE COLLAB~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "COLLAB~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
41.5MB
MD52c44817cc5e1290bb2bc186e46a5f8ba
SHA1dd1d60fdffa99ccffc2c1fb87945aa92653b03f8
SHA2560ffb65fe5a090bd43f82ff6f790007d9f1ccedc1bcfb7b4d35659bff7a333717
SHA512b00ef5bf66c2ce8b5d9a25968f481f07683033b9355b7ed9068acbf8ea0053d3f68e60365b56e7329257ae39b81acb5988da21a1d5d4846a21d6479e93bd4c67