Analysis
-
max time kernel
591s -
max time network
593s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2025, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
template letter to cancel service contract 10094.js
Resource
win10v2004-20250314-en
windows10-2004-x64
11 signatures
600 seconds
General
-
Target
template letter to cancel service contract 10094.js
-
Size
13.9MB
-
MD5
98ea723de2f4ce7c0ce6083bee82168c
-
SHA1
345780ed928b6b21b951a8c57fbd1daa21b86a0a
-
SHA256
5ab7c599252ac1c908edcbeb408e12c6398330a91bab4a21fc853731ecb4f7b1
-
SHA512
6fa08f38b7131080685ca7511db874e5a0a246ff2613f39aa31d9ee6f1d4cc1a43acc07b8725885aff70739791ebbd7485e8266f74cbfd9de0cdb7e641623ff0
-
SSDEEP
49152:hyd08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDwyd08dPXWR4ba/JOt4:1c43mvc43mvc43ml
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Gootloader family
-
Blocklisted process makes network request 17 IoCs
flow pid Process 63 5748 powershell.exe 75 5748 powershell.exe 78 5748 powershell.exe 88 5748 powershell.exe 91 5748 powershell.exe 93 5748 powershell.exe 99 5748 powershell.exe 101 5748 powershell.exe 104 5748 powershell.exe 107 5748 powershell.exe 109 5748 powershell.exe 110 5748 powershell.exe 111 5748 powershell.exe 112 5748 powershell.exe 114 5748 powershell.exe 117 5748 powershell.exe 119 5748 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation wscript.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ powershell.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe 5748 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5748 powershell.exe Token: SeIncreaseQuotaPrivilege 5748 powershell.exe Token: SeSecurityPrivilege 5748 powershell.exe Token: SeTakeOwnershipPrivilege 5748 powershell.exe Token: SeLoadDriverPrivilege 5748 powershell.exe Token: SeSystemProfilePrivilege 5748 powershell.exe Token: SeSystemtimePrivilege 5748 powershell.exe Token: SeProfSingleProcessPrivilege 5748 powershell.exe Token: SeIncBasePriorityPrivilege 5748 powershell.exe Token: SeCreatePagefilePrivilege 5748 powershell.exe Token: SeBackupPrivilege 5748 powershell.exe Token: SeRestorePrivilege 5748 powershell.exe Token: SeShutdownPrivilege 5748 powershell.exe Token: SeDebugPrivilege 5748 powershell.exe Token: SeSystemEnvironmentPrivilege 5748 powershell.exe Token: SeRemoteShutdownPrivilege 5748 powershell.exe Token: SeUndockPrivilege 5748 powershell.exe Token: SeManageVolumePrivilege 5748 powershell.exe Token: 33 5748 powershell.exe Token: 34 5748 powershell.exe Token: 35 5748 powershell.exe Token: 36 5748 powershell.exe Token: SeIncreaseQuotaPrivilege 5748 powershell.exe Token: SeSecurityPrivilege 5748 powershell.exe Token: SeTakeOwnershipPrivilege 5748 powershell.exe Token: SeLoadDriverPrivilege 5748 powershell.exe Token: SeSystemProfilePrivilege 5748 powershell.exe Token: SeSystemtimePrivilege 5748 powershell.exe Token: SeProfSingleProcessPrivilege 5748 powershell.exe Token: SeIncBasePriorityPrivilege 5748 powershell.exe Token: SeCreatePagefilePrivilege 5748 powershell.exe Token: SeBackupPrivilege 5748 powershell.exe Token: SeRestorePrivilege 5748 powershell.exe Token: SeShutdownPrivilege 5748 powershell.exe Token: SeDebugPrivilege 5748 powershell.exe Token: SeSystemEnvironmentPrivilege 5748 powershell.exe Token: SeRemoteShutdownPrivilege 5748 powershell.exe Token: SeUndockPrivilege 5748 powershell.exe Token: SeManageVolumePrivilege 5748 powershell.exe Token: 33 5748 powershell.exe Token: 34 5748 powershell.exe Token: 35 5748 powershell.exe Token: 36 5748 powershell.exe Token: SeIncreaseQuotaPrivilege 5748 powershell.exe Token: SeSecurityPrivilege 5748 powershell.exe Token: SeTakeOwnershipPrivilege 5748 powershell.exe Token: SeLoadDriverPrivilege 5748 powershell.exe Token: SeSystemProfilePrivilege 5748 powershell.exe Token: SeSystemtimePrivilege 5748 powershell.exe Token: SeProfSingleProcessPrivilege 5748 powershell.exe Token: SeIncBasePriorityPrivilege 5748 powershell.exe Token: SeCreatePagefilePrivilege 5748 powershell.exe Token: SeBackupPrivilege 5748 powershell.exe Token: SeRestorePrivilege 5748 powershell.exe Token: SeShutdownPrivilege 5748 powershell.exe Token: SeDebugPrivilege 5748 powershell.exe Token: SeSystemEnvironmentPrivilege 5748 powershell.exe Token: SeRemoteShutdownPrivilege 5748 powershell.exe Token: SeUndockPrivilege 5748 powershell.exe Token: SeManageVolumePrivilege 5748 powershell.exe Token: 33 5748 powershell.exe Token: 34 5748 powershell.exe Token: 35 5748 powershell.exe Token: 36 5748 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 640 wrote to memory of 3164 640 wscript.EXE 110 PID 640 wrote to memory of 3164 640 wscript.EXE 110 PID 3164 wrote to memory of 5748 3164 cscript.exe 113 PID 3164 wrote to memory of 5748 3164 cscript.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\template letter to cancel service contract 10094.js"1⤵PID:5444
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE BRITIS~1.JS1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "BRITIS~1.JS"2⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39.9MB
MD57f38f78a529c806e29905ed425f87f3a
SHA1d838b1902f30a973905b1d7e89b1b300daa9abaa
SHA25603f6cd790090de091c69dc208a927126e6ef13a0293aa5f3c2896b89dbbd2558
SHA512fc89c0acc45ae7de5ef40482cbe12d12fb0dddb0d010ef741ea88b34fd0a98e0008ef3dd7d53c46a01a3dab13f7020d9d92a253e5d3d43b910224a87f1667c46