deafc124bc097312f31fa48c677945da35e1d2833cd014723fb7b29f92b4c8db

Resubmissions

09-12-2022 21:32

01-12-2022 10:29

max time kernel
394s
max time network
420s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 21:32

Target

metaphysic/leveler.ps1
Size

363B
MD5

3a09963c9181f0f542ba74c629862ef8
SHA1

4c4e93f77c591590c049e5f275c088b3edd3c6bf
SHA256

2d25b2ee5fc13b485abd86b0b7fe90b274f1646bdaaee7ceaba4a85e49babdb1
SHA512

2ae4bedea2b124e8cc66835eb1dd43f8141495888f6a50f7e1ec05611807aa1d7de5f4f23f1c99f7d94f21ddc9a873567173f4f54af4c57b1ed1582c56b3d85a

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

940 powershell.exe
940 powershell.exe
940 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 940 powershell.exe

description	pid	process
Token: SeDebugPrivilege	940	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 940 wrote to memory of 268	940	powershell.exe	rundll32.exe
PID 940 wrote to memory of 268	940	powershell.exe	rundll32.exe
PID 940 wrote to memory of 268	940	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\leveler.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\users\public\dotageWithdrew.txt DrawThemeIcon
  2⤵
  PID:268

memory/268-61-0x0000000000000000-mapping.dmp

Download
memory/940-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/940-55-0x000007FEF4B20000-0x000007FEF5543000-memory.dmp

Filesize
10.1MB

Download
memory/940-57-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/940-56-0x000007FEF3FC0000-0x000007FEF4B1D000-memory.dmp

Filesize
11.4MB

Download
memory/940-58-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/940-59-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/940-60-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/940-62-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/940-63-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download