deafc124bc097312f31fa48c677945da35e1d2833cd014723fb7b29f92b4c8db

Resubmissions

09-12-2022 21:32

01-12-2022 10:29

max time kernel
281s
max time network
406s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 10:29

Target

metaphysic/leveler.ps1
Size

363B
MD5

3a09963c9181f0f542ba74c629862ef8
SHA1

4c4e93f77c591590c049e5f275c088b3edd3c6bf
SHA256

2d25b2ee5fc13b485abd86b0b7fe90b274f1646bdaaee7ceaba4a85e49babdb1
SHA512

2ae4bedea2b124e8cc66835eb1dd43f8141495888f6a50f7e1ec05611807aa1d7de5f4f23f1c99f7d94f21ddc9a873567173f4f54af4c57b1ed1582c56b3d85a

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1984 powershell.exe
1984 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1984 powershell.exe

pid	process
1984	powershell.exe
1984	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1984	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1984 wrote to memory of 1888	1984	powershell.exe	rundll32.exe
PID 1984 wrote to memory of 1888	1984	powershell.exe	rundll32.exe
PID 1984 wrote to memory of 1888	1984	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\leveler.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\dotageWithdrew.txt DrawThemeIcon
  2⤵
  PID:1888

memory/1888-60-0x0000000000000000-mapping.dmp

Download
memory/1984-54-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download
memory/1984-55-0x000007FEF4530000-0x000007FEF4F53000-memory.dmp

Filesize
10.1MB

Download
memory/1984-57-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/1984-58-0x0000000002400000-0x0000000002480000-memory.dmp

Filesize
512KB

Download
memory/1984-56-0x000007FEF39D0000-0x000007FEF452D000-memory.dmp

Filesize
11.4MB

Download
memory/1984-59-0x000000001B860000-0x000000001BB5F000-memory.dmp

Filesize
3.0MB

Download