Analysis
-
max time kernel
597s -
max time network
598s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2025, 21:43
Static task
static1
Behavioral task
behavioral1
Sample
template letter to cancel service contract 10094.js
Resource
win10v2004-20250314-en
windows10-2004-x64
11 signatures
600 seconds
General
-
Target
template letter to cancel service contract 10094.js
-
Size
13.9MB
-
MD5
98ea723de2f4ce7c0ce6083bee82168c
-
SHA1
345780ed928b6b21b951a8c57fbd1daa21b86a0a
-
SHA256
5ab7c599252ac1c908edcbeb408e12c6398330a91bab4a21fc853731ecb4f7b1
-
SHA512
6fa08f38b7131080685ca7511db874e5a0a246ff2613f39aa31d9ee6f1d4cc1a43acc07b8725885aff70739791ebbd7485e8266f74cbfd9de0cdb7e641623ff0
-
SSDEEP
49152:hyd08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDwyd08dPXWR4ba/JOt4:1c43mvc43mvc43ml
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Gootloader family
-
Blocklisted process makes network request 13 IoCs
flow pid Process 63 1396 powershell.exe 69 1396 powershell.exe 72 1396 powershell.exe 75 1396 powershell.exe 78 1396 powershell.exe 81 1396 powershell.exe 86 1396 powershell.exe 88 1396 powershell.exe 90 1396 powershell.exe 93 1396 powershell.exe 95 1396 powershell.exe 96 1396 powershell.exe 97 1396 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe 1396 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1396 powershell.exe Token: SeIncreaseQuotaPrivilege 1396 powershell.exe Token: SeSecurityPrivilege 1396 powershell.exe Token: SeTakeOwnershipPrivilege 1396 powershell.exe Token: SeLoadDriverPrivilege 1396 powershell.exe Token: SeSystemProfilePrivilege 1396 powershell.exe Token: SeSystemtimePrivilege 1396 powershell.exe Token: SeProfSingleProcessPrivilege 1396 powershell.exe Token: SeIncBasePriorityPrivilege 1396 powershell.exe Token: SeCreatePagefilePrivilege 1396 powershell.exe Token: SeBackupPrivilege 1396 powershell.exe Token: SeRestorePrivilege 1396 powershell.exe Token: SeShutdownPrivilege 1396 powershell.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeSystemEnvironmentPrivilege 1396 powershell.exe Token: SeRemoteShutdownPrivilege 1396 powershell.exe Token: SeUndockPrivilege 1396 powershell.exe Token: SeManageVolumePrivilege 1396 powershell.exe Token: 33 1396 powershell.exe Token: 34 1396 powershell.exe Token: 35 1396 powershell.exe Token: 36 1396 powershell.exe Token: SeIncreaseQuotaPrivilege 1396 powershell.exe Token: SeSecurityPrivilege 1396 powershell.exe Token: SeTakeOwnershipPrivilege 1396 powershell.exe Token: SeLoadDriverPrivilege 1396 powershell.exe Token: SeSystemProfilePrivilege 1396 powershell.exe Token: SeSystemtimePrivilege 1396 powershell.exe Token: SeProfSingleProcessPrivilege 1396 powershell.exe Token: SeIncBasePriorityPrivilege 1396 powershell.exe Token: SeCreatePagefilePrivilege 1396 powershell.exe Token: SeBackupPrivilege 1396 powershell.exe Token: SeRestorePrivilege 1396 powershell.exe Token: SeShutdownPrivilege 1396 powershell.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeSystemEnvironmentPrivilege 1396 powershell.exe Token: SeRemoteShutdownPrivilege 1396 powershell.exe Token: SeUndockPrivilege 1396 powershell.exe Token: SeManageVolumePrivilege 1396 powershell.exe Token: 33 1396 powershell.exe Token: 34 1396 powershell.exe Token: 35 1396 powershell.exe Token: 36 1396 powershell.exe Token: SeIncreaseQuotaPrivilege 1396 powershell.exe Token: SeSecurityPrivilege 1396 powershell.exe Token: SeTakeOwnershipPrivilege 1396 powershell.exe Token: SeLoadDriverPrivilege 1396 powershell.exe Token: SeSystemProfilePrivilege 1396 powershell.exe Token: SeSystemtimePrivilege 1396 powershell.exe Token: SeProfSingleProcessPrivilege 1396 powershell.exe Token: SeIncBasePriorityPrivilege 1396 powershell.exe Token: SeCreatePagefilePrivilege 1396 powershell.exe Token: SeBackupPrivilege 1396 powershell.exe Token: SeRestorePrivilege 1396 powershell.exe Token: SeShutdownPrivilege 1396 powershell.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeSystemEnvironmentPrivilege 1396 powershell.exe Token: SeRemoteShutdownPrivilege 1396 powershell.exe Token: SeUndockPrivilege 1396 powershell.exe Token: SeManageVolumePrivilege 1396 powershell.exe Token: 33 1396 powershell.exe Token: 34 1396 powershell.exe Token: 35 1396 powershell.exe Token: 36 1396 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3152 wrote to memory of 3740 3152 wscript.EXE 107 PID 3152 wrote to memory of 3740 3152 wscript.EXE 107 PID 3740 wrote to memory of 1396 3740 cscript.exe 110 PID 3740 wrote to memory of 1396 3740 cscript.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\template letter to cancel service contract 10094.js"1⤵PID:32
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE BRITIS~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "BRITIS~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39.9MB
MD57f38f78a529c806e29905ed425f87f3a
SHA1d838b1902f30a973905b1d7e89b1b300daa9abaa
SHA25603f6cd790090de091c69dc208a927126e6ef13a0293aa5f3c2896b89dbbd2558
SHA512fc89c0acc45ae7de5ef40482cbe12d12fb0dddb0d010ef741ea88b34fd0a98e0008ef3dd7d53c46a01a3dab13f7020d9d92a253e5d3d43b910224a87f1667c46