Analysis
-
max time kernel
589s -
max time network
592s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2024 12:09
Static task
static1
Behavioral task
behavioral1
Sample
union_of_taxation_employees_collective_agreement(88998).js
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
600 seconds
General
-
Target
union_of_taxation_employees_collective_agreement(88998).js
-
Size
5.3MB
-
MD5
32e8b0c3d5675dba6a372c2998e9b55e
-
SHA1
13c19a612f8671a4c6c4e7f37483c0e5e5d4bb43
-
SHA256
1f3338dbeda08ff5b4176790ad720f160e0435d3283c53b1393dd86c3fb051a0
-
SHA512
bee58ff3db81361eb203d961c575e56085621a3fe6348094c8b07e35b7066f0b5499ceec31cb9357070bb9b3678e6f549eeb8f3fd3ed5c80bc73492c837c9735
-
SSDEEP
49152:xkfcnNhkwrcfqcGUs+LfHQekfcnNhkwrcfqcGUs+LfHQekfcnNhkwrcfqcGUs+LI:xuuu+
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 26 IoCs
flow pid Process 37 860 powershell.exe 45 860 powershell.exe 48 860 powershell.exe 50 860 powershell.exe 51 860 powershell.exe 53 860 powershell.exe 56 860 powershell.exe 59 860 powershell.exe 60 860 powershell.exe 62 860 powershell.exe 64 860 powershell.exe 70 860 powershell.exe 73 860 powershell.exe 75 860 powershell.exe 77 860 powershell.exe 80 860 powershell.exe 82 860 powershell.exe 84 860 powershell.exe 85 860 powershell.exe 86 860 powershell.exe 87 860 powershell.exe 88 860 powershell.exe 89 860 powershell.exe 91 860 powershell.exe 92 860 powershell.exe 93 860 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 860 powershell.exe Token: SeIncreaseQuotaPrivilege 860 powershell.exe Token: SeSecurityPrivilege 860 powershell.exe Token: SeTakeOwnershipPrivilege 860 powershell.exe Token: SeLoadDriverPrivilege 860 powershell.exe Token: SeSystemProfilePrivilege 860 powershell.exe Token: SeSystemtimePrivilege 860 powershell.exe Token: SeProfSingleProcessPrivilege 860 powershell.exe Token: SeIncBasePriorityPrivilege 860 powershell.exe Token: SeCreatePagefilePrivilege 860 powershell.exe Token: SeBackupPrivilege 860 powershell.exe Token: SeRestorePrivilege 860 powershell.exe Token: SeShutdownPrivilege 860 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeSystemEnvironmentPrivilege 860 powershell.exe Token: SeRemoteShutdownPrivilege 860 powershell.exe Token: SeUndockPrivilege 860 powershell.exe Token: SeManageVolumePrivilege 860 powershell.exe Token: 33 860 powershell.exe Token: 34 860 powershell.exe Token: 35 860 powershell.exe Token: 36 860 powershell.exe Token: SeIncreaseQuotaPrivilege 860 powershell.exe Token: SeSecurityPrivilege 860 powershell.exe Token: SeTakeOwnershipPrivilege 860 powershell.exe Token: SeLoadDriverPrivilege 860 powershell.exe Token: SeSystemProfilePrivilege 860 powershell.exe Token: SeSystemtimePrivilege 860 powershell.exe Token: SeProfSingleProcessPrivilege 860 powershell.exe Token: SeIncBasePriorityPrivilege 860 powershell.exe Token: SeCreatePagefilePrivilege 860 powershell.exe Token: SeBackupPrivilege 860 powershell.exe Token: SeRestorePrivilege 860 powershell.exe Token: SeShutdownPrivilege 860 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeSystemEnvironmentPrivilege 860 powershell.exe Token: SeRemoteShutdownPrivilege 860 powershell.exe Token: SeUndockPrivilege 860 powershell.exe Token: SeManageVolumePrivilege 860 powershell.exe Token: 33 860 powershell.exe Token: 34 860 powershell.exe Token: 35 860 powershell.exe Token: 36 860 powershell.exe Token: SeIncreaseQuotaPrivilege 860 powershell.exe Token: SeSecurityPrivilege 860 powershell.exe Token: SeTakeOwnershipPrivilege 860 powershell.exe Token: SeLoadDriverPrivilege 860 powershell.exe Token: SeSystemProfilePrivilege 860 powershell.exe Token: SeSystemtimePrivilege 860 powershell.exe Token: SeProfSingleProcessPrivilege 860 powershell.exe Token: SeIncBasePriorityPrivilege 860 powershell.exe Token: SeCreatePagefilePrivilege 860 powershell.exe Token: SeBackupPrivilege 860 powershell.exe Token: SeRestorePrivilege 860 powershell.exe Token: SeShutdownPrivilege 860 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeSystemEnvironmentPrivilege 860 powershell.exe Token: SeRemoteShutdownPrivilege 860 powershell.exe Token: SeUndockPrivilege 860 powershell.exe Token: SeManageVolumePrivilege 860 powershell.exe Token: 33 860 powershell.exe Token: 34 860 powershell.exe Token: 35 860 powershell.exe Token: 36 860 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 624 wrote to memory of 4500 624 wscript.EXE 92 PID 624 wrote to memory of 4500 624 wscript.EXE 92 PID 4500 wrote to memory of 860 4500 cscript.exe 94 PID 4500 wrote to memory of 860 4500 cscript.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\union_of_taxation_employees_collective_agreement(88998).js1⤵PID:3852
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE YEASTT~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "YEASTT~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
46.7MB
MD5c4a8e80bcc7dd339dbda9fcddcb178e2
SHA1b3a551ed832c373c40bfc6422f9b65dc176659be
SHA25682d658efad331d4ce1d4634e11ef32ad09417559f62476806b4e95b6a2e5b20a
SHA512a2bee52286ad880b73bf1ab2cd293ab27aec22213f8681512a2180b0f15cfd67927e1dac62127064c18fe2059cfb9bb7150447254fcbfcd1bdf05797087fc4bb