e8265e1760c285bab27fe8817adcd5e6228c81dcebafe41e6de818856a61db65 | Triage

Resubmissions

09-12-2022 21:29

221209-1cd95ahc3z 10

01-12-2022 14:21

221201-rpb6vsfg89 10

Analysis

max time kernel
518s
max time network
521s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 21:29

Sharing

Report Analysis Logs

General

Target

metaphysic/flag.ps1
Size

362B
MD5

d755b1b1ae9c898fb5f990dfc6f6aca2
SHA1

ab5f6d18ba717c432e667f2e5d9dd22daef91e58
SHA256

be0a553c1e70ee99768d88d732f83fd1f15e12c974bdc0ccabe5ede71cbd162d
SHA512

d0b2e42a75a30e612bb7a6f08d09fb4c80f5c6f298553b2f04b5729c00fc4af4ac1b8ce3738b9741eed62acf032552e75106a88118e31add9a6689403ae162f7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3248 powershell.exe
3248 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3248 powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 3248 wrote to memory of 2232	3248	powershell.exe	rundll32.exe
PID 3248 wrote to memory of 2232	3248	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\flag.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\users\public\madamSmuggler.txt DrawThemeIcon
2⤵
PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-134-0x0000000000000000-mapping.dmp

Download
memory/3248-132-0x00000271688E0000-0x0000027168902000-memory.dmp

Filesize
136KB

Download
memory/3248-133-0x00007FFDF4740000-0x00007FFDF5201000-memory.dmp

Filesize
10.8MB

Download
memory/3248-135-0x00007FFDF4740000-0x00007FFDF5201000-memory.dmp

Filesize
10.8MB

Download