ba2680549e33524c3b96c4b2be01c47297e977fe7532034936d8baa4f6dc3104

Analysis

Target

34ce23e0cac1eb85e253f52b87c53436.js
Size

256B
MD5

34ce23e0cac1eb85e253f52b87c53436
SHA1

fbc026960fc1009eae89f7506276a5e153ec58ec
SHA256

ba2680549e33524c3b96c4b2be01c47297e977fe7532034936d8baa4f6dc3104
SHA512

488b7d7cc0a3a723273f4bac17f4b45daa9c894d03af15b6c14e84d9f9b4ee3fa7d263b03fb3c12c78361a4a9d92b77a6e7a25e323b9494e937ba1ca6be92c9d

Score

10^/10

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cdn.discordapp.com/attachments/908377323814916189/915315815404953630/yuniiii.txt

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1052 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1052 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1052 powershell.exe

flow	pid	process
5	1052	powershell.exe

pid	process
1052	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1096 wrote to memory of 1052	1096	wscript.exe	powershell.exe
PID 1096 wrote to memory of 1052	1096	wscript.exe	powershell.exe
PID 1096 wrote to memory of 1052	1096	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\34ce23e0cac1eb85e253f52b87c53436.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

memory/1052-56-0x0000000000000000-mapping.dmp

Download
memory/1052-58-0x000007FEF2C80000-0x000007FEF37DD000-memory.dmp

Filesize
11.4MB

Download
memory/1052-59-0x0000000002660000-0x0000000002662000-memory.dmp

Filesize
8KB

Download
memory/1052-60-0x0000000002662000-0x0000000002664000-memory.dmp

Filesize
8KB

Download
memory/1052-61-0x0000000002664000-0x0000000002667000-memory.dmp

Filesize
12KB

Download
memory/1052-62-0x000000000266B000-0x000000000268A000-memory.dmp

Filesize
124KB

Download
memory/1096-55-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download