2f7517bb9127d88aa84c804e2a6324203ab0044cb43808973066008fd5ff55ce

Resubmissions

09-12-2022 21:29

02-12-2022 06:18

max time kernel
38s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 06:18

Target

metaphysic/bootstrap.ps1
Size

371B
MD5

16f9b6d8274f528af9053feed19895ce
SHA1

74215c7063493e3ece465afcc9884b33f51fb77f
SHA256

b08613e04e946bc1a2e62d88bfde1724430750b9432349a4db865e888ee3b064
SHA512

904802723071e4aa910e4b585ecbda1672783741fcca56947aaa274eb0114a3afd58acbb1690539ecbe0331c4276cb591207269775c508cc136dd0bf7bedb60f

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

928 powershell.exe
928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 928 powershell.exe

pid	process
928	powershell.exe
928	powershell.exe

description	pid	process
Token: SeDebugPrivilege	928	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 928 wrote to memory of 1100	928	powershell.exe	rundll32.exe
PID 928 wrote to memory of 1100	928	powershell.exe	rundll32.exe
PID 928 wrote to memory of 1100	928	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\bootstrap.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\clairvoyantButtonholes.txt DrawThemeIcon
  2⤵
  PID:1100

memory/928-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/928-55-0x000007FEF45A0000-0x000007FEF4FC3000-memory.dmp

Filesize
10.1MB

Download
memory/928-57-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/928-56-0x000007FEF3A40000-0x000007FEF459D000-memory.dmp

Filesize
11.4MB

Download
memory/928-58-0x000000001B790000-0x000000001BA8F000-memory.dmp

Filesize
3.0MB

Download
memory/928-59-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download
memory/928-62-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download
memory/928-61-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/1100-60-0x0000000000000000-mapping.dmp

Download