f6c5d0064568344d3c56561bcc3e6b843a1bba496a4c372f451fe5831d3cce8f

Resubmissions

09-12-2022 21:30

01-12-2022 16:56

max time kernel
411s
max time network
415s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 21:30

Target

teased/vehemently.ps1
Size

362B
MD5

303ff5de570252c4623e1482e05dc5a2
SHA1

2a3fd1038d4b4071749256e5db1b95c9f7d1ee1a
SHA256

fa84d10f15990f651fac05a1a1eba427cf124589673f6017e88bc173c8a49ed1
SHA512

56e6399a52b57a2332c4e4ebb2441d02474aac5bc8b70efe1e1ce7d2e6c59e2f9ecef7e2995363534ca0996bce6db0f984f6cec55b06108bd085aea211b2db02

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

868 powershell.exe
868 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 868 powershell.exe

pid	process
868	powershell.exe
868	powershell.exe

description	pid	process
Token: SeDebugPrivilege	868	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 868 wrote to memory of 1916	868	powershell.exe	rundll32.exe
PID 868 wrote to memory of 1916	868	powershell.exe	rundll32.exe
PID 868 wrote to memory of 1916	868	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\teased\vehemently.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\confidingNewscast.txt DrawThemeIcon
  2⤵
  PID:1916

memory/868-54-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Filesize
8KB

Download
memory/868-55-0x000007FEF3D10000-0x000007FEF4733000-memory.dmp

Filesize
10.1MB

Download
memory/868-56-0x000007FEF31B0000-0x000007FEF3D0D000-memory.dmp

Filesize
11.4MB

Download
memory/868-57-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/868-59-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/868-60-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/1916-58-0x0000000000000000-mapping.dmp

Download