gootloader | 7332d16a2078e910b20382a7e8c429a9cc5f83050f2bd14c8539140483802d8f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

union_of_taxation_employees_collective_agreement19793.js
Size

3.9MB
MD5

5d9834e74e7cbbb4a085435b764c7e90
SHA1

a66ff6625f9b7d72e09da4d6e3aabea085be801b
SHA256

7332d16a2078e910b20382a7e8c429a9cc5f83050f2bd14c8539140483802d8f
SHA512

33f36a600ffb336a93891ca159b72048c2b3fbf5cb42c5b2c094d555d6f40538ae359cfe1d07d3dc90fe17bd739c6fd447e9f53021bcf784831d5c5f1c8d637a
SSDEEP

24576:b175xd0GGB7NQPV9LR175xd0GGB7NQPV9LR175xd0GGB7NQPV9LZ:b1pEKPV9N1pEKPV9N1pEKPV9l

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
1656	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	1656	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	Process	procid_target
PID 2820 wrote to memory of 2752	2820	taskeng.exe	32
PID 2820 wrote to memory of 2752	2820	taskeng.exe	32
PID 2820 wrote to memory of 2752	2820	taskeng.exe	32
PID 2752 wrote to memory of 2784	2752	wscript.EXE	33
PID 2752 wrote to memory of 2784	2752	wscript.EXE	33
PID 2752 wrote to memory of 2784	2752	wscript.EXE	33
PID 2784 wrote to memory of 1656	2784	cscript.exe	35
PID 2784 wrote to memory of 1656	2784	cscript.exe	35
PID 2784 wrote to memory of 1656	2784	cscript.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\union_of_taxation_employees_collective_agreement19793.js
1⤵
PID:1600

C:\Windows\system32\taskeng.exe
taskeng.exe {D0F5DEDF-B814-4307-8BE9-D49C471D92D3} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE GRAPHI~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" GRAPHI~1.JS
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Macromedia\GRAPHI~1.JS

Filesize
39.3MB

MD5
20300a3375658a050bd3e0cc833d35b3

SHA1
8cdc8e0320178081fa45eba198f3e04af05cd60d

SHA256
4b92bcd7904d1f5644218c2bfc613ad800e97bfcf7fb44d2f9bc6b9976a1f232

SHA512
9bf39c8bd176d518a48d235ad37965b8842620506a56a4d7a8d86dd79680b77c3dae7894c471d8bf376ba603d005c25a3022e17fbba1451d8c9408218d135687

Download Submit
memory/1656-7-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/1656-8-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download