gootloader | 95e2205bfcc9cd16ce54c703dd3f514e49d6a606f8265fbf77b60388ba0fb00c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

airline baggage agreement 31221.js
Size

8.8MB
MD5

ca93562528adff608bee7c962c65ed02
SHA1

8b2d9cb6f0133522f765c0de5222c24640ac1c4b
SHA256

95e2205bfcc9cd16ce54c703dd3f514e49d6a606f8265fbf77b60388ba0fb00c
SHA512

ed3a37a286297c2036e184e74073a8cbb6158ed2425ee16d1f6ddacc6803561758adee1c6828fce374abfdde492b2d5be8052664836e1db82f709c4a0a839b47
SSDEEP

49152:6ytwpCQK+7cytwpCQK+7cytwpCQK+7cytwpCQK+7cytwpCQK+7cytwpCQK+7cytd:H

Score

10^/10

gootloader execution loader

Malware Config

Signatures

GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
loader gootloader
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2760 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2760 powershell.exe

pid	process
2760	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2760	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	process	target process
PID 2588 wrote to memory of 2424	2588	taskeng.exe	wscript.EXE
PID 2588 wrote to memory of 2424	2588	taskeng.exe	wscript.EXE
PID 2588 wrote to memory of 2424	2588	taskeng.exe	wscript.EXE
PID 2424 wrote to memory of 2912	2424	wscript.EXE	cscript.exe
PID 2424 wrote to memory of 2912	2424	wscript.EXE	cscript.exe
PID 2424 wrote to memory of 2912	2424	wscript.EXE	cscript.exe
PID 2912 wrote to memory of 2760	2912	cscript.exe	powershell.exe
PID 2912 wrote to memory of 2760	2912	cscript.exe	powershell.exe
PID 2912 wrote to memory of 2760	2912	cscript.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\airline baggage agreement 31221.js"
1⤵
PID:1196

C:\Windows\system32\taskeng.exe
taskeng.exe {49A3371E-8C86-4510-82B7-91F81FA47B54} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE WEB-BA~1.JS
2⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" "WEB-BA~1.JS"
3⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\WEB-BA~1.JS
Filesize
39.9MB

MD5
13aec28e171c57e33dcc53916e0d74e0

SHA1
613c526933b61d59c122c7a83fffd0fc04e950a8

SHA256
5455f46fc2fa2a81e48f11d5346062758cc6993ca5350c87564a9879e92c432c

SHA512
6eff6c1df0001f42c8ff3db2527a5d83d73c9b478a6a274719b0e082e0ac9f84db123d2f767bbf1f1b7bfcd7d467751effcc073b7dfa848f3c63843a7e664098

Download Submit
memory/2760-7-0x000000001B880000-0x000000001BB62000-memory.dmp

Filesize
2.9MB

Download
memory/2760-8-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download