Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 14:12
Static task
static1
Behavioral task
behavioral1
Sample
b72dc2b479a9f8a1a9e55eb6bd21a823d4f5ccefc20e566b3d00fd8811185a7f.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b72dc2b479a9f8a1a9e55eb6bd21a823d4f5ccefc20e566b3d00fd8811185a7f.js
Resource
win10v2004-20240802-en
General
-
Target
b72dc2b479a9f8a1a9e55eb6bd21a823d4f5ccefc20e566b3d00fd8811185a7f.js
-
Size
10.6MB
-
MD5
1d0bf84687e2a729b33f415e558e7fdb
-
SHA1
cc4e6437fa0a216540b10498c7d5e7c7854b4550
-
SHA256
b72dc2b479a9f8a1a9e55eb6bd21a823d4f5ccefc20e566b3d00fd8811185a7f
-
SHA512
950bd85e04d2be8aab4f68d7cbba73144557bd4a08c7086a8805f01260b19f8ea069ecb9caa15f5dcadd0e4e2b7baf963fa0cfecb6939054750560d168c14391
-
SSDEEP
49152:ZZmKvXnWYiwPNgEHF/s+LfHQeZmKvXnWYiwPNgEHF/s+LfHQeZmKvXnWYiwPNgE1:Z1F1F1F1F1F1F1F1z
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 37 4984 powershell.exe 47 4984 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepid Process 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 4984 powershell.exe Token: SeIncreaseQuotaPrivilege 4984 powershell.exe Token: SeSecurityPrivilege 4984 powershell.exe Token: SeTakeOwnershipPrivilege 4984 powershell.exe Token: SeLoadDriverPrivilege 4984 powershell.exe Token: SeSystemProfilePrivilege 4984 powershell.exe Token: SeSystemtimePrivilege 4984 powershell.exe Token: SeProfSingleProcessPrivilege 4984 powershell.exe Token: SeIncBasePriorityPrivilege 4984 powershell.exe Token: SeCreatePagefilePrivilege 4984 powershell.exe Token: SeBackupPrivilege 4984 powershell.exe Token: SeRestorePrivilege 4984 powershell.exe Token: SeShutdownPrivilege 4984 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeSystemEnvironmentPrivilege 4984 powershell.exe Token: SeRemoteShutdownPrivilege 4984 powershell.exe Token: SeUndockPrivilege 4984 powershell.exe Token: SeManageVolumePrivilege 4984 powershell.exe Token: 33 4984 powershell.exe Token: 34 4984 powershell.exe Token: 35 4984 powershell.exe Token: 36 4984 powershell.exe Token: SeIncreaseQuotaPrivilege 4984 powershell.exe Token: SeSecurityPrivilege 4984 powershell.exe Token: SeTakeOwnershipPrivilege 4984 powershell.exe Token: SeLoadDriverPrivilege 4984 powershell.exe Token: SeSystemProfilePrivilege 4984 powershell.exe Token: SeSystemtimePrivilege 4984 powershell.exe Token: SeProfSingleProcessPrivilege 4984 powershell.exe Token: SeIncBasePriorityPrivilege 4984 powershell.exe Token: SeCreatePagefilePrivilege 4984 powershell.exe Token: SeBackupPrivilege 4984 powershell.exe Token: SeRestorePrivilege 4984 powershell.exe Token: SeShutdownPrivilege 4984 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeSystemEnvironmentPrivilege 4984 powershell.exe Token: SeRemoteShutdownPrivilege 4984 powershell.exe Token: SeUndockPrivilege 4984 powershell.exe Token: SeManageVolumePrivilege 4984 powershell.exe Token: 33 4984 powershell.exe Token: 34 4984 powershell.exe Token: 35 4984 powershell.exe Token: 36 4984 powershell.exe Token: SeIncreaseQuotaPrivilege 4984 powershell.exe Token: SeSecurityPrivilege 4984 powershell.exe Token: SeTakeOwnershipPrivilege 4984 powershell.exe Token: SeLoadDriverPrivilege 4984 powershell.exe Token: SeSystemProfilePrivilege 4984 powershell.exe Token: SeSystemtimePrivilege 4984 powershell.exe Token: SeProfSingleProcessPrivilege 4984 powershell.exe Token: SeIncBasePriorityPrivilege 4984 powershell.exe Token: SeCreatePagefilePrivilege 4984 powershell.exe Token: SeBackupPrivilege 4984 powershell.exe Token: SeRestorePrivilege 4984 powershell.exe Token: SeShutdownPrivilege 4984 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeSystemEnvironmentPrivilege 4984 powershell.exe Token: SeRemoteShutdownPrivilege 4984 powershell.exe Token: SeUndockPrivilege 4984 powershell.exe Token: SeManageVolumePrivilege 4984 powershell.exe Token: 33 4984 powershell.exe Token: 34 4984 powershell.exe Token: 35 4984 powershell.exe Token: 36 4984 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 1892 wrote to memory of 2348 1892 wscript.EXE 96 PID 1892 wrote to memory of 2348 1892 wscript.EXE 96 PID 2348 wrote to memory of 4984 2348 cscript.exe 98 PID 2348 wrote to memory of 4984 2348 cscript.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\b72dc2b479a9f8a1a9e55eb6bd21a823d4f5ccefc20e566b3d00fd8811185a7f.js1⤵PID:4864
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE COLLAB~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "COLLAB~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
41.5MB
MD52c44817cc5e1290bb2bc186e46a5f8ba
SHA1dd1d60fdffa99ccffc2c1fb87945aa92653b03f8
SHA2560ffb65fe5a090bd43f82ff6f790007d9f1ccedc1bcfb7b4d35659bff7a333717
SHA512b00ef5bf66c2ce8b5d9a25968f481f07683033b9355b7ed9068acbf8ea0053d3f68e60365b56e7329257ae39b81acb5988da21a1d5d4846a21d6479e93bd4c67