Analysis
- max time kernel
141s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/10/2024, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
union_of_taxation_employees_collective_agreement13780.js
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
union_of_taxation_employees_collective_agreement13780.js
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target union_of_taxation_employees_collective_agreement13780.js
- Size 6.4MB
- Sample241009-p7489avdln
- SHA256 420aa512b3478fd7245746384258ea221887ee6bcec21c96ddfda0123e838763
- MD5 7b01e48178b20f98a7044be8e9fba8e3
- SHA1 18220e55b120e47fbbd04bd2515e07e57b1afc04
- SHA512 d124ba79d22c1e284fdd58f210a8245206a368b8232611e9d16cef51a78b427963dde15f1f570c87c591957a4df31e4ebfa310a23f56cbb22f4c081a288caf94
- SSDEEP 49152:wsWOuJPV9qsWOuJPV9qsWOuJPV9qsWOuJPV9qsWOuJPV9l:XmPVzmPVzmPVzmPVzmPVD
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Blocklisted process makes network request 2 IoCs
flow pid Process 40 3484 powershell.exe 43 3484 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation wscript.EXE - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3484 powershell.exe 3484 powershell.exe 3484 powershell.exe 3484 powershell.exe 3484 powershell.exe 3484 powershell.exe 3484 powershell.exe 3484 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3484 powershell.exe Token: SeIncreaseQuotaPrivilege 3484 powershell.exe Token: SeSecurityPrivilege 3484 powershell.exe Token: SeTakeOwnershipPrivilege 3484 powershell.exe Token: SeLoadDriverPrivilege 3484 powershell.exe Token: SeSystemProfilePrivilege 3484 powershell.exe Token: SeSystemtimePrivilege 3484 powershell.exe Token: SeProfSingleProcessPrivilege 3484 powershell.exe Token: SeIncBasePriorityPrivilege 3484 powershell.exe Token: SeCreatePagefilePrivilege 3484 powershell.exe Token: SeBackupPrivilege 3484 powershell.exe Token: SeRestorePrivilege 3484 powershell.exe Token: SeShutdownPrivilege 3484 powershell.exe Token: SeDebugPrivilege 3484 powershell.exe Token: SeSystemEnvironmentPrivilege 3484 powershell.exe Token: SeRemoteShutdownPrivilege 3484 powershell.exe Token: SeUndockPrivilege 3484 powershell.exe Token: SeManageVolumePrivilege 3484 powershell.exe Token: 33 3484 powershell.exe Token: 34 3484 powershell.exe Token: 35 3484 powershell.exe Token: 36 3484 powershell.exe Token: SeIncreaseQuotaPrivilege 3484 powershell.exe Token: SeSecurityPrivilege 3484 powershell.exe Token: SeTakeOwnershipPrivilege 3484 powershell.exe Token: SeLoadDriverPrivilege 3484 powershell.exe Token: SeSystemProfilePrivilege 3484 powershell.exe Token: SeSystemtimePrivilege 3484 powershell.exe Token: SeProfSingleProcessPrivilege 3484 powershell.exe Token: SeIncBasePriorityPrivilege 3484 powershell.exe Token: SeCreatePagefilePrivilege 3484 powershell.exe Token: SeBackupPrivilege 3484 powershell.exe Token: SeRestorePrivilege 3484 powershell.exe Token: SeShutdownPrivilege 3484 powershell.exe Token: SeDebugPrivilege 3484 powershell.exe Token: SeSystemEnvironmentPrivilege 3484 powershell.exe Token: SeRemoteShutdownPrivilege 3484 powershell.exe Token: SeUndockPrivilege 3484 powershell.exe Token: SeManageVolumePrivilege 3484 powershell.exe Token: 33 3484 powershell.exe Token: 34 3484 powershell.exe Token: 35 3484 powershell.exe Token: 36 3484 powershell.exe Token: SeIncreaseQuotaPrivilege 3484 powershell.exe Token: SeSecurityPrivilege 3484 powershell.exe Token: SeTakeOwnershipPrivilege 3484 powershell.exe Token: SeLoadDriverPrivilege 3484 powershell.exe Token: SeSystemProfilePrivilege 3484 powershell.exe Token: SeSystemtimePrivilege 3484 powershell.exe Token: SeProfSingleProcessPrivilege 3484 powershell.exe Token: SeIncBasePriorityPrivilege 3484 powershell.exe Token: SeCreatePagefilePrivilege 3484 powershell.exe Token: SeBackupPrivilege 3484 powershell.exe Token: SeRestorePrivilege 3484 powershell.exe Token: SeShutdownPrivilege 3484 powershell.exe Token: SeDebugPrivilege 3484 powershell.exe Token: SeSystemEnvironmentPrivilege 3484 powershell.exe Token: SeRemoteShutdownPrivilege 3484 powershell.exe Token: SeUndockPrivilege 3484 powershell.exe Token: SeManageVolumePrivilege 3484 powershell.exe Token: 33 3484 powershell.exe Token: 34 3484 powershell.exe Token: 35 3484 powershell.exe Token: 36 3484 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4776 wrote to memory of 1872 4776 wscript.EXE 91 PID 4776 wrote to memory of 1872 4776 wscript.EXE 91 PID 1872 wrote to memory of 3484 1872 cscript.exe 93 PID 1872 wrote to memory of 3484 1872 cscript.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\union_of_taxation_employees_collective_agreement13780.js1⤵PID:840
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE NATURA~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" NATURA~1.JS2⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eeazrbuq.i2e.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Sun\NATURA~1.JS
- Size 40.0MB
- SHA256 e753156693f1746df7c5fa655eaf87e009b2c9fd3ddb7a2c9b98574d731c0c89
- MD5 ada323c95ce888c38127036afbd1e134
- SHA1 ec3915c33c278c3786e4932025baa93a579247ac
- SHA512 c1ce3f491b9cae7ba388d0dea7128933a439bc2d9c1119294c25608409fc532ccb5d068826722eab94f5846420bf5437ca59ffaf8cc4e49ec290b74ef563a4ca
- SSDEEP 393216:qVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVW:T
- MD5 SHA1 SHA512 SSDEEP