gootloader | 26a68f915f48c1cdacb8896940edd55395d68ae44236b13360304e8975937865

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

is homemade pepper spray legal uk 42639.js
Size

844KB
MD5

c4cb6d8700cce08b4002b9a3bedec327
SHA1

4e7b6909037eff3974eaac12f5b2d9baad82b448
SHA256

26a68f915f48c1cdacb8896940edd55395d68ae44236b13360304e8975937865
SHA512

0679eba75c9be3b63f7a3b5fc07b6f0d57194d03eba3fff3bb36a54f309eb5b1862795247d5052f2a54e752ad89d0cf8396823936c766d8d966e3d17a5c8bf1d
SSDEEP

24576:CFCgo+ogQc5WfNnZmD/nFHTuyxUeGZ/YLWpyQTaEFNE3NE2:CFCgo+ogQc5WfNnZmD/nZTuyvlWpyQTo

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2984	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	Process	procid_target
PID 2372 wrote to memory of 2824	2372	taskeng.exe	32
PID 2372 wrote to memory of 2824	2372	taskeng.exe	32
PID 2372 wrote to memory of 2824	2372	taskeng.exe	32
PID 2824 wrote to memory of 2604	2824	wscript.EXE	33
PID 2824 wrote to memory of 2604	2824	wscript.EXE	33
PID 2824 wrote to memory of 2604	2824	wscript.EXE	33
PID 2604 wrote to memory of 2984	2604	cscript.exe	35
PID 2604 wrote to memory of 2984	2604	cscript.exe	35
PID 2604 wrote to memory of 2984	2604	cscript.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\is homemade pepper spray legal uk 42639.js"
1⤵
PID:2308

C:\Windows\system32\taskeng.exe
taskeng.exe {7966FD49-B19D-44FC-909D-81CFAC3F9184} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE MONTHL~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "MONTHL~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\MONTHL~1.JS

Filesize
42.7MB

MD5
885a5f15e566caf386bbb3c8181d9416

SHA1
ce66cb18853d2d709760e3b81d165e35be147f0a

SHA256
436566dd395586c2a4eab80259e52ad4713dfab9caa1138e3d5acbb16725141e

SHA512
a4e740c9eee86908f76f6f0c1bdc6394ae7db4d459b903474e21089568aafce66e360cbd87a6000d249b08c24aeb2493e5372cb80d61a9a2d1fa6302bb2cd1e0

Download Submit
memory/2984-7-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2984-8-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download