125726d3f9feeed75f6d885a638d6671ca997cb1947f429d39bd332fcd35e7ce | Triage

Analysis

max time kernel
135s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 14:35

Sharing

Report Analysis Logs

General

Target

fix/mummy.ps1
Size

375B
MD5

dbf28894fb58ea26193c70b40a51fa1b
SHA1

ee5b9086bd687d118e290072a1b35c398d919fba
SHA256

290c540176f7349262548213d2d78d6813e585d8981b0a948e8c9f2fffbd1cbc
SHA512

a4413bf676d4991bd500200168a7dcffeec5a96ae4f6608c9fbf7bec70307e7f79108d61dbe4c207712403eae35d4f44d1f06cba28e8a2c87dd6aba4e53947a6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2584 powershell.exe
2584 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2584 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 2584 wrote to memory of 1448	2584	powershell.exe	rundll32.exe
PID 2584 wrote to memory of 1448	2584	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\fix\mummy.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\shockableVictors.jpg DrawThemeIcon
2⤵
PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-134-0x0000000000000000-mapping.dmp

Download
memory/2584-132-0x0000018EA72B0000-0x0000018EA72D2000-memory.dmp

Filesize
136KB

Download
memory/2584-133-0x00007FFDF4740000-0x00007FFDF5201000-memory.dmp

Filesize
10.8MB

Download
memory/2584-135-0x00007FFDF4740000-0x00007FFDF5201000-memory.dmp

Filesize
10.8MB

Download