c3cbf54a0103490dc5581d766e4462e4b5eb9e8cd45c9c97853e3bdd5e1361d7 | Triage

Resubmissions

30-11-2022 21:30

221130-1cq9paba9x 10

30-11-2022 21:10

221130-zz49dshg41 3

Analysis

max time kernel
1196s
max time network
1203s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
30-11-2022 21:30

Sharing

Report Analysis Logs

General

Target

metaphysic/donatory.ps1
Size

363B
MD5

19ada07528b7493d500da761e7e0e1d2
SHA1

474bd679811af56b40eacf5a1b3a54d3cd16ea18
SHA256

8507b2bce4d6b05206a245ed60753d8876145327ea16407fad5c7a920100eb3a
SHA512

0157e7f2721b3947753cf03817862b836b73dfceb8c31c406866e26f1db5f4af8175520a7a1336c0990a9f56cba418c1fdf0f579712a9b4a3851420548047359

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

4008 powershell.exe
4008 powershell.exe
4008 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4008 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 4008 wrote to memory of 4988	4008	powershell.exe	rundll32.exe
PID 4008 wrote to memory of 4988	4008	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\donatory.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\muskUnflurried.txt DrawThemeIcon
2⤵
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4008-124-0x00000284F27D0000-0x00000284F27F2000-memory.dmp

Filesize
136KB

Download
memory/4008-127-0x00000284F2980000-0x00000284F29F6000-memory.dmp

Filesize
472KB

Download
memory/4988-148-0x0000000000000000-mapping.dmp

Download