2f7517bb9127d88aa84c804e2a6324203ab0044cb43808973066008fd5ff55ce | Triage

Resubmissions

09-12-2022 21:29

221209-1b834sed53 10

02-12-2022 06:18

221202-g2rrzaea7z 10

Analysis

max time kernel
551s
max time network
573s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 21:29

Sharing

Report Analysis Logs

General

Target

metaphysic/bootstrap.ps1
Size

371B
MD5

16f9b6d8274f528af9053feed19895ce
SHA1

74215c7063493e3ece465afcc9884b33f51fb77f
SHA256

b08613e04e946bc1a2e62d88bfde1724430750b9432349a4db865e888ee3b064
SHA512

904802723071e4aa910e4b585ecbda1672783741fcca56947aaa274eb0114a3afd58acbb1690539ecbe0331c4276cb591207269775c508cc136dd0bf7bedb60f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1276 powershell.exe
1276 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1276 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1276 wrote to memory of 3276	1276	powershell.exe	rundll32.exe
PID 1276 wrote to memory of 3276	1276	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\bootstrap.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\clairvoyantButtonholes.txt DrawThemeIcon
  2⤵
  PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-132-0x00000288E91F0000-0x00000288E9212000-memory.dmp

Filesize
136KB

Download
memory/1276-133-0x00007FFCFF110000-0x00007FFCFFBD1000-memory.dmp

Filesize
10.8MB

Download
memory/1276-134-0x00007FFCFF110000-0x00007FFCFFBD1000-memory.dmp

Filesize
10.8MB

Download
memory/1276-136-0x00007FFCFF110000-0x00007FFCFFBD1000-memory.dmp

Filesize
10.8MB

Download
memory/3276-135-0x0000000000000000-mapping.dmp

Download