Analysis
- max time kernel
128s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/10/2024, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
freeinformalloanagreementtemplate.js
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
freeinformalloanagreementtemplate.js
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target freeinformalloanagreementtemplate.js
- Size 841KB
- Sample241003-cmkynashmf
- SHA256 0a67499a709b1644c4770067be6a7bd932c601d6d09552e4e35e2dacbafa2c77
- MD5 7ac78182e549eb40175d21cc87b94b62
- SHA1 b9d41cfaa5df3d6855403876871b4bdbea3185be
- SHA512 c31b241714a68b2234aaadccf08fd320df77f7f33dba54d7032167086cb230d632a8b6a34614797be48ef70223158a7d9684a8b18f7fffb6b66dc44e37a06ef7
- SSDEEP 24576:ZQCgo+ogQc5WfNnZmD/n95ajjhxeB2rRhWpyQTaEFNE3NEr:ZQCgo+ogQc5WfNnZmD/nDajj+8WpyQTZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Blocklisted process makes network request 3 IoCs
flow pid Process 51 3212 pOweRshELl.exe 52 3212 pOweRshELl.exe 55 3212 pOweRshELl.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation wscript.EXE - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ pOweRshELl.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ pOweRshELl.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3212 pOweRshELl.exe 3212 pOweRshELl.exe 3212 pOweRshELl.exe 3212 pOweRshELl.exe 3212 pOweRshELl.exe 3212 pOweRshELl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3212 pOweRshELl.exe Token: SeIncreaseQuotaPrivilege 3212 pOweRshELl.exe Token: SeSecurityPrivilege 3212 pOweRshELl.exe Token: SeTakeOwnershipPrivilege 3212 pOweRshELl.exe Token: SeLoadDriverPrivilege 3212 pOweRshELl.exe Token: SeSystemProfilePrivilege 3212 pOweRshELl.exe Token: SeSystemtimePrivilege 3212 pOweRshELl.exe Token: SeProfSingleProcessPrivilege 3212 pOweRshELl.exe Token: SeIncBasePriorityPrivilege 3212 pOweRshELl.exe Token: SeCreatePagefilePrivilege 3212 pOweRshELl.exe Token: SeBackupPrivilege 3212 pOweRshELl.exe Token: SeRestorePrivilege 3212 pOweRshELl.exe Token: SeShutdownPrivilege 3212 pOweRshELl.exe Token: SeDebugPrivilege 3212 pOweRshELl.exe Token: SeSystemEnvironmentPrivilege 3212 pOweRshELl.exe Token: SeRemoteShutdownPrivilege 3212 pOweRshELl.exe Token: SeUndockPrivilege 3212 pOweRshELl.exe Token: SeManageVolumePrivilege 3212 pOweRshELl.exe Token: 33 3212 pOweRshELl.exe Token: 34 3212 pOweRshELl.exe Token: 35 3212 pOweRshELl.exe Token: 36 3212 pOweRshELl.exe Token: SeIncreaseQuotaPrivilege 3212 pOweRshELl.exe Token: SeSecurityPrivilege 3212 pOweRshELl.exe Token: SeTakeOwnershipPrivilege 3212 pOweRshELl.exe Token: SeLoadDriverPrivilege 3212 pOweRshELl.exe Token: SeSystemProfilePrivilege 3212 pOweRshELl.exe Token: SeSystemtimePrivilege 3212 pOweRshELl.exe Token: SeProfSingleProcessPrivilege 3212 pOweRshELl.exe Token: SeIncBasePriorityPrivilege 3212 pOweRshELl.exe Token: SeCreatePagefilePrivilege 3212 pOweRshELl.exe Token: SeBackupPrivilege 3212 pOweRshELl.exe Token: SeRestorePrivilege 3212 pOweRshELl.exe Token: SeShutdownPrivilege 3212 pOweRshELl.exe Token: SeDebugPrivilege 3212 pOweRshELl.exe Token: SeSystemEnvironmentPrivilege 3212 pOweRshELl.exe Token: SeRemoteShutdownPrivilege 3212 pOweRshELl.exe Token: SeUndockPrivilege 3212 pOweRshELl.exe Token: SeManageVolumePrivilege 3212 pOweRshELl.exe Token: 33 3212 pOweRshELl.exe Token: 34 3212 pOweRshELl.exe Token: 35 3212 pOweRshELl.exe Token: 36 3212 pOweRshELl.exe Token: SeIncreaseQuotaPrivilege 3212 pOweRshELl.exe Token: SeSecurityPrivilege 3212 pOweRshELl.exe Token: SeTakeOwnershipPrivilege 3212 pOweRshELl.exe Token: SeLoadDriverPrivilege 3212 pOweRshELl.exe Token: SeSystemProfilePrivilege 3212 pOweRshELl.exe Token: SeSystemtimePrivilege 3212 pOweRshELl.exe Token: SeProfSingleProcessPrivilege 3212 pOweRshELl.exe Token: SeIncBasePriorityPrivilege 3212 pOweRshELl.exe Token: SeCreatePagefilePrivilege 3212 pOweRshELl.exe Token: SeBackupPrivilege 3212 pOweRshELl.exe Token: SeRestorePrivilege 3212 pOweRshELl.exe Token: SeShutdownPrivilege 3212 pOweRshELl.exe Token: SeDebugPrivilege 3212 pOweRshELl.exe Token: SeSystemEnvironmentPrivilege 3212 pOweRshELl.exe Token: SeRemoteShutdownPrivilege 3212 pOweRshELl.exe Token: SeUndockPrivilege 3212 pOweRshELl.exe Token: SeManageVolumePrivilege 3212 pOweRshELl.exe Token: 33 3212 pOweRshELl.exe Token: 34 3212 pOweRshELl.exe Token: 35 3212 pOweRshELl.exe Token: 36 3212 pOweRshELl.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 64 1912 wscript.EXE 92 PID 1912 wrote to memory of 64 1912 wscript.EXE 92 PID 64 wrote to memory of 3212 64 cscript.exe 94 PID 64 wrote to memory of 3212 64 cscript.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\freeinformalloanagreementtemplate.js1⤵PID:1076
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE TECHNI~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "TECHNI~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\System32\WindowsPowerShell\v1.0\pOweRshELl.exepOweRshELl.exe3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sbfjug1f.olc.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\TECHNI~1.JS
- Size 42.6MB
- SHA256 3d5c3f2de7234018f3d3f0c621bddda9d37e5e10af685571cee6ef3fbb702f4d
- MD5 86a8c18e20c3e53742597e3738965424
- SHA1 144c35ea3a387c32effeeccfb94e356b1dc6b1e6
- SHA512 ae56a4df90a5e8a581d4286a9a94303bca25182753a32f05977db97c6e5abee08f6f169a1cee27925cd77f60c723d0d059324fde69ec4013c4e7fe1a2422f8d2
- SSDEEP 12288:gUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuWQUuq:f
- MD5 SHA1 SHA512 SSDEEP