643df2597cf46fa8713f2da393626757541e4a1452fdf63291e0eff41b6ede3d | Triage

Resubmissions

09-12-2022 20:56

221209-zq79pahb41 10

01-12-2022 18:24

221201-w17jcsbb8t 10

Analysis

max time kernel
95s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 18:24

Sharing

Report Analysis Logs

General

Target

teased/abscissa.ps1
Size

355B
MD5

20cf9d5f6cc639a6d38452d8edc084fd
SHA1

f9ceef9fee9df8ae9c62e76ed5fea63ab8410cd0
SHA256

2907d56ca8297efd6b4ef7e2215c2a5248beff1d72bff36dfed0b9d8abd5ea53
SHA512

f61a460e2262a8e1b3aed4d0fbdf64c3c5d8b86a53a6df789e4e3f560079149d2848d10d31601b339b9c9f72f0238753e54746f01408dd4ca663b892153c8be1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1656 powershell.exe
1656 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1656 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1656 wrote to memory of 2372	1656	powershell.exe	rundll32.exe
PID 1656 wrote to memory of 2372	1656	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\teased\abscissa.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\sievedStar.txt DrawThemeIcon
2⤵
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-132-0x0000019CFB1C0000-0x0000019CFB1E2000-memory.dmp

Filesize
136KB

Download
memory/1656-133-0x00007FFA31BE0000-0x00007FFA326A1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-135-0x00007FFA31BE0000-0x00007FFA326A1000-memory.dmp

Filesize
10.8MB

Download
memory/2372-134-0x0000000000000000-mapping.dmp

Download