Resubmissions
06/11/2024, 14:58
241106-scaypssgpq1005/11/2024, 08:20
241105-j8fdmaxkbv1004/11/2024, 22:26
241104-2cpxasxrdy10Analysis
- max time kernel
579s - max time network
582s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
05/11/2024, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
Dr. Lalusin-form_cheque_request_ff-NRGH-Site Visit.js
Resource
win7-20240903-en
windows7-x64
6 signatures
600 seconds
Behavioral task
behavioral2
Sample
Dr. Lalusin-form_cheque_request_ff-NRGH-Site Visit.js
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
600 seconds
General
- Target Dr. Lalusin-form_cheque_request_ff-NRGH-Site Visit.js
- Size 281KB
- Sample241105-j8fdmaxkbv
- SHA256 12151d0287a0c4974d42aef01f5f6f35dd69021ffe4d01adb804962d423534d4
- MD5 710137b0c23b5aeab171afcde3098416
- SHA1 7acab22c5c54d9ed4db06e0baf882b6da3e34f05
- SHA512 55456ecd1e3485c073cae90a7aafe78b9082542efba7ba5dda246a9685c202763c2d5a01f32e9d9b32b13fe90cc9e5e81b21e02be5a064cbfd5d5dc0ba30ea24
- SSDEEP 6144:he3Ih6n3cpC1ywXTgjL64OfbsD5QHFmnIIJF28s8OvMIcI1fEZaATRZtr:h+D4OfsqFmu8TMMO1fEZaATtr
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Gootloader family
- Blocklisted process makes network request 29 IoCs
flow pid Process 48 1020 powershell.exe 66 1020 powershell.exe 69 1020 powershell.exe 72 1020 powershell.exe 75 1020 powershell.exe 77 1020 powershell.exe 79 1020 powershell.exe 80 1020 powershell.exe 82 1020 powershell.exe 83 1020 powershell.exe 85 1020 powershell.exe 88 1020 powershell.exe 90 1020 powershell.exe 91 1020 powershell.exe 95 1020 powershell.exe 96 1020 powershell.exe 97 1020 powershell.exe 98 1020 powershell.exe 99 1020 powershell.exe 100 1020 powershell.exe 102 1020 powershell.exe 105 1020 powershell.exe 106 1020 powershell.exe 107 1020 powershell.exe 108 1020 powershell.exe 109 1020 powershell.exe 110 1020 powershell.exe 111 1020 powershell.exe 112 1020 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation wscript.EXE - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe 1020 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1020 powershell.exe Token: SeIncreaseQuotaPrivilege 1020 powershell.exe Token: SeSecurityPrivilege 1020 powershell.exe Token: SeTakeOwnershipPrivilege 1020 powershell.exe Token: SeLoadDriverPrivilege 1020 powershell.exe Token: SeSystemProfilePrivilege 1020 powershell.exe Token: SeSystemtimePrivilege 1020 powershell.exe Token: SeProfSingleProcessPrivilege 1020 powershell.exe Token: SeIncBasePriorityPrivilege 1020 powershell.exe Token: SeCreatePagefilePrivilege 1020 powershell.exe Token: SeBackupPrivilege 1020 powershell.exe Token: SeRestorePrivilege 1020 powershell.exe Token: SeShutdownPrivilege 1020 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeSystemEnvironmentPrivilege 1020 powershell.exe Token: SeRemoteShutdownPrivilege 1020 powershell.exe Token: SeUndockPrivilege 1020 powershell.exe Token: SeManageVolumePrivilege 1020 powershell.exe Token: 33 1020 powershell.exe Token: 34 1020 powershell.exe Token: 35 1020 powershell.exe Token: 36 1020 powershell.exe Token: SeIncreaseQuotaPrivilege 1020 powershell.exe Token: SeSecurityPrivilege 1020 powershell.exe Token: SeTakeOwnershipPrivilege 1020 powershell.exe Token: SeLoadDriverPrivilege 1020 powershell.exe Token: SeSystemProfilePrivilege 1020 powershell.exe Token: SeSystemtimePrivilege 1020 powershell.exe Token: SeProfSingleProcessPrivilege 1020 powershell.exe Token: SeIncBasePriorityPrivilege 1020 powershell.exe Token: SeCreatePagefilePrivilege 1020 powershell.exe Token: SeBackupPrivilege 1020 powershell.exe Token: SeRestorePrivilege 1020 powershell.exe Token: SeShutdownPrivilege 1020 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeSystemEnvironmentPrivilege 1020 powershell.exe Token: SeRemoteShutdownPrivilege 1020 powershell.exe Token: SeUndockPrivilege 1020 powershell.exe Token: SeManageVolumePrivilege 1020 powershell.exe Token: 33 1020 powershell.exe Token: 34 1020 powershell.exe Token: 35 1020 powershell.exe Token: 36 1020 powershell.exe Token: SeIncreaseQuotaPrivilege 1020 powershell.exe Token: SeSecurityPrivilege 1020 powershell.exe Token: SeTakeOwnershipPrivilege 1020 powershell.exe Token: SeLoadDriverPrivilege 1020 powershell.exe Token: SeSystemProfilePrivilege 1020 powershell.exe Token: SeSystemtimePrivilege 1020 powershell.exe Token: SeProfSingleProcessPrivilege 1020 powershell.exe Token: SeIncBasePriorityPrivilege 1020 powershell.exe Token: SeCreatePagefilePrivilege 1020 powershell.exe Token: SeBackupPrivilege 1020 powershell.exe Token: SeRestorePrivilege 1020 powershell.exe Token: SeShutdownPrivilege 1020 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeSystemEnvironmentPrivilege 1020 powershell.exe Token: SeRemoteShutdownPrivilege 1020 powershell.exe Token: SeUndockPrivilege 1020 powershell.exe Token: SeManageVolumePrivilege 1020 powershell.exe Token: 33 1020 powershell.exe Token: 34 1020 powershell.exe Token: 35 1020 powershell.exe Token: 36 1020 powershell.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4620 wrote to memory of 3420 4620 wscript.EXE 99 PID 4620 wrote to memory of 3420 4620 wscript.EXE 99 PID 3420 wrote to memory of 5000 3420 cmd.exe 101 PID 3420 wrote to memory of 5000 3420 cmd.exe 101 PID 5000 wrote to memory of 1020 5000 cscript.exe 102 PID 5000 wrote to memory of 1020 5000 cscript.exe 102 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Dr. Lalusin-form_cheque_request_ff-NRGH-Site Visit.js"1⤵PID:3172
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE PREGNA~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c csCRipT "PREGNA~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\system32\cscript.execsCRipT "PREGNA~1.JS"3⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell4⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpx143rm.uof.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Acceptance Criteria.txt
- Size 46.8MB
- SHA256 3ef0176980a98f9a138c6c306f0f534aef6eb097aa18e8d77b9d85d4b5639c4b
- MD5 d0000f75cc9654918be94ab0b7767071
- SHA1 f343d8b8ef9e3204e965430404ce78c1c8766a8d
- SHA512 9a144efaafb9bcebf10a25e591f2d218f52f15b15ea12e9ff122aabdf0a35a4a13f991e1faedf6ccdc090c07f12809350cae8305e6e3fc99968c15329661868d
- SSDEEP 12288:F77777777777777777777777777777777777777777777777777777777777777R:H
- MD5 SHA1 SHA512 SSDEEP