Analysis
- max time kernel
65s - max time network
138s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
09/06/2026, 14:53
General
- Target tmpsjqvy_tw.js
- Size 841KB
- Sample260609-r9be3act6z
- SHA256 d3c937335f6eadbe0b2436070e757dfff0b64724d86bf63c0a10aae4d84c5ea4
Malware Config
Signatures
- Family: GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\tmpsjqvy_tw.js1⤵
-
C:\Windows\system32\wscript.exewscript1⤵
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE COLLEG~1.JS1⤵
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "COLLEG~1.JS"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kp4oyre2.tba.ps1
COLLEG~1.JS
memory/4592-3-0x00000227742B0000-0x00000227742D2000-memory.dmp
memory/4592-10-0x0000022774700000-0x0000022774746000-memory.dmp
memory/4592-11-0x0000022773060000-0x0000022773B22000-memory.dmp
memory/4592-13-0x0000022773060000-0x0000022773B22000-memory.dmp
memory/4592-14-0x0000022773060000-0x0000022773B22000-memory.dmp
memory/4592-15-0x0000022773060000-0x0000022773B22000-memory.dmp
memory/4592-16-0x0000022773060000-0x0000022773B22000-memory.dmp
memory/4592-18-0x0000022773060000-0x0000022773B22000-memory.dmp