cadc4b5d3da925f221cfb090fea16485be53f6e070d2181886380b10f082830a | Triage

Analysis

max time kernel
153s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 08:23

Sharing

Report Analysis Logs

General

Target

fix/catechism.ps1
Size

374B
MD5

bf2437ef024bd621ba8e748186588e3a
SHA1

ba5d13ad4ff7826da49eb5af902d5654c9f7853d
SHA256

cb1e267954a684aa76d838aa4ff80235feb94fb7bb70116cd2d400a2fb8072e3
SHA512

3a81841d66e877baa7142b3548aa73b30befc3432150db912c0288fbaa87c1a00411c302e6cd5129735d1bceb3a3635bce4b34f7191a8a587928127e093069ef

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

220 powershell.exe
220 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 220 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 220 wrote to memory of 3368	220	powershell.exe	rundll32.exe
PID 220 wrote to memory of 3368	220	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\catechism.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\umlautsCapsized.jpg DrawThemeIcon
2⤵
PID:3368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-132-0x000002587E7E0000-0x000002587E802000-memory.dmp

Filesize
136KB

Download
memory/220-133-0x00007FFEC8C70000-0x00007FFEC9731000-memory.dmp

Filesize
10.8MB

Download
memory/220-134-0x00007FFEC8C70000-0x00007FFEC9731000-memory.dmp

Filesize
10.8MB

Download
memory/220-136-0x00007FFEC8C70000-0x00007FFEC9731000-memory.dmp

Filesize
10.8MB

Download
memory/3368-135-0x0000000000000000-mapping.dmp

Download