b6e8a316e550183223d1fa66fec47171f402799ad37ed1b8c65a03b156c0b06e | Triage

Analysis

max time kernel
71s
max time network
86s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
30-11-2022 19:39

Sharing

Report Analysis Logs

General

Target

metaphysic/vaulted.ps1
Size

365B
MD5

e7191cc473f66a3adb133fba449ccdc0
SHA1

353a5b24b3991f81536aa5bbf6b3bdf221cd18a7
SHA256

a3b00b825641f9c253568750e36ec6a1352bd8d4f847b8656820150a84fed98b
SHA512

e180cc1c8d710e3efdc3e8e84770faa05c4837a7d057b44ffa96d7e5665bd9f2b89aab86bd833e00312212a22b181d8414510c8e7f9e4310b19c97844321f84e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

4200 powershell.exe
4200 powershell.exe
4200 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4200 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 4200 wrote to memory of 2744	4200	powershell.exe	rundll32.exe
PID 4200 wrote to memory of 2744	4200	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\vaulted.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\debaterSapphires.txt DrawThemeIcon
2⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-143-0x0000000000000000-mapping.dmp

Download
memory/4200-119-0x00000259A62F0000-0x00000259A6312000-memory.dmp

Filesize
136KB

Download
memory/4200-122-0x00000259BED00000-0x00000259BED76000-memory.dmp

Filesize
472KB

Download