3da1cb0608f3709bf1331c4088fb258daf0200740b9b67afc6eec68a7f4b111a | Triage

Resubmissions

28-11-2022 19:20

221128-x14m5sad69 10

28-11-2022 13:53

221128-q6zg2sgg66 10

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 13:53

Sharing

Report Analysis Logs

General

Target

peseta/gratiae.ps1
Size

367B
MD5

5479e1a9617b0222d0a8f001c63fb23b
SHA1

0c5428239a418c8586d1699adafeb2bddb0f8c95
SHA256

e6f4fe47c6e08c3b995b5e69efee09a853426607d64715bb1cf215640f785d58
SHA512

7bc5e090fbabd4746c1a075ed4d7bbfbdb4e0a235ff8c1be5e8257d5daf4f3e22a3f04d25d21108446a684cc7371eea6882d3c1d855a3c12e868a2e8d01d4ffa

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1760 powershell.exe
1760 powershell.exe
1760 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1760 powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1760 wrote to memory of 1488	1760	powershell.exe	rundll32.exe
PID 1760 wrote to memory of 1488	1760	powershell.exe	rundll32.exe
PID 1760 wrote to memory of 1488	1760	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\peseta\gratiae.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\test1.txt DrawThemeIcon
2⤵
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-58-0x0000000000000000-mapping.dmp

Download
memory/1760-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x000007FEF33C0000-0x000007FEF3DE3000-memory.dmp

Filesize
10.1MB

Download
memory/1760-56-0x000007FEF2860000-0x000007FEF33BD000-memory.dmp

Filesize
11.4MB

Download
memory/1760-57-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download