2f7517bb9127d88aa84c804e2a6324203ab0044cb43808973066008fd5ff55ce

Resubmissions

09-12-2022 21:29

02-12-2022 06:18

max time kernel
368s
max time network
395s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 21:29

Target

metaphysic/bootstrap.ps1
Size

371B
MD5

16f9b6d8274f528af9053feed19895ce
SHA1

74215c7063493e3ece465afcc9884b33f51fb77f
SHA256

b08613e04e946bc1a2e62d88bfde1724430750b9432349a4db865e888ee3b064
SHA512

904802723071e4aa910e4b585ecbda1672783741fcca56947aaa274eb0114a3afd58acbb1690539ecbe0331c4276cb591207269775c508cc136dd0bf7bedb60f

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1972 powershell.exe
1972 powershell.exe
1972 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1972 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1972 wrote to memory of 564	1972	powershell.exe	rundll32.exe
PID 1972 wrote to memory of 564	1972	powershell.exe	rundll32.exe
PID 1972 wrote to memory of 564	1972	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\bootstrap.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\clairvoyantButtonholes.txt DrawThemeIcon
  2⤵
  PID:564

memory/564-61-0x0000000000000000-mapping.dmp

Download
memory/1972-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x000007FEF3410000-0x000007FEF3E33000-memory.dmp

Filesize
10.1MB

Download
memory/1972-57-0x00000000022D0000-0x0000000002350000-memory.dmp

Filesize
512KB

Download
memory/1972-58-0x00000000022D0000-0x0000000002350000-memory.dmp

Filesize
512KB

Download
memory/1972-56-0x000007FEF28B0000-0x000007FEF340D000-memory.dmp

Filesize
11.4MB

Download
memory/1972-59-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/1972-60-0x00000000022D0000-0x0000000002350000-memory.dmp

Filesize
512KB

Download