gootloader | 7f4843033e0eab23d10f46b052a26ef6afbcbbf03b2c7aefc1b8da28f4865476

Analysis

max time kernel
107s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

are_gun_racks_legal_in_canada(3955).js
Size

10.3MB
MD5

ffbd99b04c4bec6d730b95321027ee56
SHA1

b8e2aa6c7be077a9c5fa642308f8fc77c713845e
SHA256

7f4843033e0eab23d10f46b052a26ef6afbcbbf03b2c7aefc1b8da28f4865476
SHA512

e858081d6423de23fff1e80b19619f3fb26fc5095233fa38de577989169a0a225bb164eb84fc4653807ac0399579109320c88e1fd4a19526699b5248ba451860
SSDEEP

98304:FmPVJmPVJmPVJmPVJmPVJmPVJmPVJmPVD:n

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1816	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2692	2624	taskeng.exe	30
PID 2624 wrote to memory of 2692	2624	taskeng.exe	30
PID 2624 wrote to memory of 2692	2624	taskeng.exe	30
PID 2692 wrote to memory of 676	2692	wscript.EXE	31
PID 2692 wrote to memory of 676	2692	wscript.EXE	31
PID 2692 wrote to memory of 676	2692	wscript.EXE	31
PID 676 wrote to memory of 1816	676	cscript.exe	33
PID 676 wrote to memory of 1816	676	cscript.exe	33
PID 676 wrote to memory of 1816	676	cscript.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\are_gun_racks_legal_in_canada(3955).js
1⤵
PID:2016

C:\Windows\system32\taskeng.exe
taskeng.exe {B44EDCE4-9A08-444A-805B-28B03CE5BBA2} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE CRITIC~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" CRITIC~1.JS
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\CRITIC~1.JS

Filesize
42.8MB

MD5
478f4818530accb1f81a6e09e4bfdf76

SHA1
1f9c2cf17ddbc7711731fabb9eda564d1fff9dd8

SHA256
f4cc15ff975a06f71413a34bc080c3b9a428872e843b82af94b487a2a30905e5

SHA512
00c085062c5f64c330d0604a5cccab474a039286409d5132a4ccc141ea50488f1bd9f2c0c63060f20572f58176edeb2b90803e3e6edd3a7808fc425a6affb999

Download Submit
memory/1816-7-0x000000001B420000-0x000000001B702000-memory.dmp

Filesize
2.9MB

Download
memory/1816-8-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download