643df2597cf46fa8713f2da393626757541e4a1452fdf63291e0eff41b6ede3d | Triage

Resubmissions

09-12-2022 20:56

221209-zq79pahb41 10

01-12-2022 18:24

221201-w17jcsbb8t 10

Analysis

max time kernel
64s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 18:24

Sharing

Report Analysis Logs

General

Target

teased/abscissa.ps1
Size

355B
MD5

20cf9d5f6cc639a6d38452d8edc084fd
SHA1

f9ceef9fee9df8ae9c62e76ed5fea63ab8410cd0
SHA256

2907d56ca8297efd6b4ef7e2215c2a5248beff1d72bff36dfed0b9d8abd5ea53
SHA512

f61a460e2262a8e1b3aed4d0fbdf64c3c5d8b86a53a6df789e4e3f560079149d2848d10d31601b339b9c9f72f0238753e54746f01408dd4ca663b892153c8be1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1252 powershell.exe
1252 powershell.exe
1252 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1252 powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1252 wrote to memory of 468	1252	powershell.exe	rundll32.exe
PID 1252 wrote to memory of 468	1252	powershell.exe	rundll32.exe
PID 1252 wrote to memory of 468	1252	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\teased\abscissa.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\sievedStar.txt DrawThemeIcon
2⤵
PID:468

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-58-0x0000000000000000-mapping.dmp

Download
memory/1252-54-0x000007FEFB7C1000-0x000007FEFB7C3000-memory.dmp

Filesize
8KB

Download
memory/1252-55-0x000007FEF3350000-0x000007FEF3D73000-memory.dmp

Filesize
10.1MB

Download
memory/1252-56-0x000007FEF27F0000-0x000007FEF334D000-memory.dmp

Filesize
11.4MB

Download
memory/1252-57-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download