646c5b0bc32d7f37a4370756116b820e9231ef929308f42e89a32ea5d3427d26 | Triage

Resubmissions

09-12-2022 20:54

221209-zqdp3sec62 10

01-12-2022 16:23

221201-tvtzzafd56 10

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 16:23

Sharing

Report Analysis Logs

General

Target

teased/phallic.ps1
Size

364B
MD5

6e7cf38081b202b76d7fd016655fb768
SHA1

b9afacb0bb1c48d50503a5065df9ab07e80cde7a
SHA256

61ab7ec54c252b9ed26568d22c57496b8386d9c26fbbaa978970dcdd42b0e0c3
SHA512

8d75549e5c80fbf7c2eb51be45a596c253c37e99e5b8c403327b617861b4f4efd66152cf6270a49436dd4163437a846f7b63dd3aa0d5d9f5f5a4b98714b90e05

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4332 powershell.exe
4332 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4332 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 4332 wrote to memory of 4952	4332	powershell.exe	rundll32.exe
PID 4332 wrote to memory of 4952	4332	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\teased\phallic.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\modicumDenunciators.txt DrawThemeIcon
2⤵
PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4332-132-0x0000024AC8CF0000-0x0000024AC8D12000-memory.dmp

Filesize
136KB

Download
memory/4332-133-0x00007FFA02680000-0x00007FFA03141000-memory.dmp

Filesize
10.8MB

Download
memory/4332-135-0x00007FFA02680000-0x00007FFA03141000-memory.dmp

Filesize
10.8MB

Download
memory/4952-134-0x0000000000000000-mapping.dmp

Download