8a947b74dc7aa05f98851a8a62e71e983cee37d32d18a7ba1e1e5cb357e830c2 | Triage

Analysis

max time kernel
180s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 17:36

Sharing

Report Analysis Logs

General

Target

teased/mammary.ps1
Size

363B
MD5

1afca7e01104c41276d5407b5a26a4db
SHA1

a65e352c96a6d7c61741503874e3b395a17d3c1b
SHA256

ade01ba047aea55733967891270a531473996e31d8b38f02d56f6d2102d1a393
SHA512

7d7648ae9532196508d08cf7954144c3c25617ebfde58b64e4ef7fba8349457e3dca5cdb75184ae6cbf828a5dd8b4cb016f1854df3405ea2ca6ed952bbf9d0e9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2612 powershell.exe
2612 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2612 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 2612 wrote to memory of 5104	2612	powershell.exe	rundll32.exe
PID 2612 wrote to memory of 5104	2612	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\teased\mammary.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\marqueesInvariance.txt DrawThemeIcon
2⤵
PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-132-0x0000016CB2610000-0x0000016CB2632000-memory.dmp

Filesize
136KB

Download
memory/2612-133-0x00007FFDC03C0000-0x00007FFDC0E81000-memory.dmp

Filesize
10.8MB

Download
memory/2612-135-0x00007FFDC03C0000-0x00007FFDC0E81000-memory.dmp

Filesize
10.8MB

Download
memory/5104-134-0x0000000000000000-mapping.dmp

Download