Analysis
-
max time kernel
289s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
union_of_taxation_employees_collective_agreement(35285).js
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
union_of_taxation_employees_collective_agreement(35285).js
-
Size
10.6MB
-
MD5
a4941b073a1cf1183a4f3be6ac321ce4
-
SHA1
41383a555a57144cdce8d3bea8d61123c15c6148
-
SHA256
d69806d3e2d3a414278334188894d3c3f1704f047aa9cb72d6b85f48f7de45b0
-
SHA512
4d42854364311f17db09edc2cd8bc535a03dbdd8972bd608963adb63dcb3a8ec258479d00fa2cfd84ef11c7b5779f94e955b403ed3317309463a394a282fa82a
-
SSDEEP
49152:H3ncwnVlbwzu6Uvq/s+LfHQe3ncwnVlbwzu6Uvq/s+LfHQe3ncwnVlbwzu6Uvq/Q:H4444444s
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 12 IoCs
Processes:
powershell.exeflow pid Process 46 3120 powershell.exe 49 3120 powershell.exe 50 3120 powershell.exe 52 3120 powershell.exe 53 3120 powershell.exe 55 3120 powershell.exe 56 3120 powershell.exe 58 3120 powershell.exe 61 3120 powershell.exe 64 3120 powershell.exe 66 3120 powershell.exe 67 3120 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.EXEdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exepid Process 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe 3120 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 3120 powershell.exe Token: SeIncreaseQuotaPrivilege 3120 powershell.exe Token: SeSecurityPrivilege 3120 powershell.exe Token: SeTakeOwnershipPrivilege 3120 powershell.exe Token: SeLoadDriverPrivilege 3120 powershell.exe Token: SeSystemProfilePrivilege 3120 powershell.exe Token: SeSystemtimePrivilege 3120 powershell.exe Token: SeProfSingleProcessPrivilege 3120 powershell.exe Token: SeIncBasePriorityPrivilege 3120 powershell.exe Token: SeCreatePagefilePrivilege 3120 powershell.exe Token: SeBackupPrivilege 3120 powershell.exe Token: SeRestorePrivilege 3120 powershell.exe Token: SeShutdownPrivilege 3120 powershell.exe Token: SeDebugPrivilege 3120 powershell.exe Token: SeSystemEnvironmentPrivilege 3120 powershell.exe Token: SeRemoteShutdownPrivilege 3120 powershell.exe Token: SeUndockPrivilege 3120 powershell.exe Token: SeManageVolumePrivilege 3120 powershell.exe Token: 33 3120 powershell.exe Token: 34 3120 powershell.exe Token: 35 3120 powershell.exe Token: 36 3120 powershell.exe Token: SeIncreaseQuotaPrivilege 3120 powershell.exe Token: SeSecurityPrivilege 3120 powershell.exe Token: SeTakeOwnershipPrivilege 3120 powershell.exe Token: SeLoadDriverPrivilege 3120 powershell.exe Token: SeSystemProfilePrivilege 3120 powershell.exe Token: SeSystemtimePrivilege 3120 powershell.exe Token: SeProfSingleProcessPrivilege 3120 powershell.exe Token: SeIncBasePriorityPrivilege 3120 powershell.exe Token: SeCreatePagefilePrivilege 3120 powershell.exe Token: SeBackupPrivilege 3120 powershell.exe Token: SeRestorePrivilege 3120 powershell.exe Token: SeShutdownPrivilege 3120 powershell.exe Token: SeDebugPrivilege 3120 powershell.exe Token: SeSystemEnvironmentPrivilege 3120 powershell.exe Token: SeRemoteShutdownPrivilege 3120 powershell.exe Token: SeUndockPrivilege 3120 powershell.exe Token: SeManageVolumePrivilege 3120 powershell.exe Token: 33 3120 powershell.exe Token: 34 3120 powershell.exe Token: 35 3120 powershell.exe Token: 36 3120 powershell.exe Token: SeIncreaseQuotaPrivilege 3120 powershell.exe Token: SeSecurityPrivilege 3120 powershell.exe Token: SeTakeOwnershipPrivilege 3120 powershell.exe Token: SeLoadDriverPrivilege 3120 powershell.exe Token: SeSystemProfilePrivilege 3120 powershell.exe Token: SeSystemtimePrivilege 3120 powershell.exe Token: SeProfSingleProcessPrivilege 3120 powershell.exe Token: SeIncBasePriorityPrivilege 3120 powershell.exe Token: SeCreatePagefilePrivilege 3120 powershell.exe Token: SeBackupPrivilege 3120 powershell.exe Token: SeRestorePrivilege 3120 powershell.exe Token: SeShutdownPrivilege 3120 powershell.exe Token: SeDebugPrivilege 3120 powershell.exe Token: SeSystemEnvironmentPrivilege 3120 powershell.exe Token: SeRemoteShutdownPrivilege 3120 powershell.exe Token: SeUndockPrivilege 3120 powershell.exe Token: SeManageVolumePrivilege 3120 powershell.exe Token: 33 3120 powershell.exe Token: 34 3120 powershell.exe Token: 35 3120 powershell.exe Token: 36 3120 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.EXEcscript.exedescription pid Process procid_target PID 4008 wrote to memory of 4900 4008 wscript.EXE 95 PID 4008 wrote to memory of 4900 4008 wscript.EXE 95 PID 4900 wrote to memory of 3120 4900 cscript.exe 97 PID 4900 wrote to memory of 3120 4900 cscript.exe 97 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\union_of_taxation_employees_collective_agreement(35285).js1⤵PID:2912
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE GREENH~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "GREENH~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
45.6MB
MD5242b497332d9530865c2f289142ee316
SHA1929d35e1b006a260bc5db0d29460bcfcf6b3c7e6
SHA25679caf357853137fc47f9467ddac92602207dcf9775fd07db5cafaf2874f6d20f
SHA512c04f71d9249d3302b91b41138297a4bee889d79d241f1ebde08ca31cc909daba2ef39c6b9d2c8e9f5ef591e5b0f93c6083db6b1d0a3da80453a91e18b60b2f88