2f7517bb9127d88aa84c804e2a6324203ab0044cb43808973066008fd5ff55ce | Triage

Analysis

max time kernel
176s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 06:13

Sharing

Report Analysis Logs

General

Target

metaphysic/bootstrap.ps1
Size

371B
MD5

16f9b6d8274f528af9053feed19895ce
SHA1

74215c7063493e3ece465afcc9884b33f51fb77f
SHA256

b08613e04e946bc1a2e62d88bfde1724430750b9432349a4db865e888ee3b064
SHA512

904802723071e4aa910e4b585ecbda1672783741fcca56947aaa274eb0114a3afd58acbb1690539ecbe0331c4276cb591207269775c508cc136dd0bf7bedb60f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1248 powershell.exe
1248 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1248 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1248 wrote to memory of 3408	1248	powershell.exe	rundll32.exe
PID 1248 wrote to memory of 3408	1248	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\bootstrap.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\clairvoyantButtonholes.txt DrawThemeIcon
  2⤵
  PID:3408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-132-0x000001757CA50000-0x000001757CA72000-memory.dmp

Filesize
136KB

Download
memory/1248-133-0x00007FF91EA90000-0x00007FF91F551000-memory.dmp

Filesize
10.8MB

Download
memory/1248-134-0x00007FF91EA90000-0x00007FF91F551000-memory.dmp

Filesize
10.8MB

Download
memory/1248-136-0x00007FF91EA90000-0x00007FF91F551000-memory.dmp

Filesize
10.8MB

Download
memory/3408-135-0x0000000000000000-mapping.dmp

Download