2f7517bb9127d88aa84c804e2a6324203ab0044cb43808973066008fd5ff55ce | Triage

Resubmissions

09-12-2022 21:29

221209-1b834sed53 10

02-12-2022 06:18

221202-g2rrzaea7z 10

Analysis

max time kernel
146s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 06:18

Sharing

Report Analysis Logs

General

Target

metaphysic/bootstrap.ps1
Size

371B
MD5

16f9b6d8274f528af9053feed19895ce
SHA1

74215c7063493e3ece465afcc9884b33f51fb77f
SHA256

b08613e04e946bc1a2e62d88bfde1724430750b9432349a4db865e888ee3b064
SHA512

904802723071e4aa910e4b585ecbda1672783741fcca56947aaa274eb0114a3afd58acbb1690539ecbe0331c4276cb591207269775c508cc136dd0bf7bedb60f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2792 powershell.exe
2792 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2792 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 2792 wrote to memory of 1792	2792	powershell.exe	rundll32.exe
PID 2792 wrote to memory of 1792	2792	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\bootstrap.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\clairvoyantButtonholes.txt DrawThemeIcon
2⤵
PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-137-0x0000000000000000-mapping.dmp

Download
memory/2792-135-0x000001DB6CF10000-0x000001DB6CF32000-memory.dmp

Filesize
136KB

Download
memory/2792-136-0x00007FFB3D400000-0x00007FFB3DEC1000-memory.dmp

Filesize
10.8MB

Download
memory/2792-138-0x00007FFB3D400000-0x00007FFB3DEC1000-memory.dmp

Filesize
10.8MB

Download