Analysis

  • max time kernel
    43s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2023, 05:36

General

  • Target

    metaphysic/possessively.ps1

  • Size

    364B

  • MD5

    fdd112c79808f54c51315a2db79543a3

  • SHA1

    ed4e556ee19f1066494870a2bb6c4714800dad20

  • SHA256

    b9efb8b9e271b08de4b59d78720796e7b428a989e8d7cb05f01713ea526b86dd

  • SHA512

    95c1215833e1490d42fd041f0f3203c0f11bd70e889d4f1017f0e9533318c1c99c7a797c463016022fc79d0b4493198311ffa1b3476a1e29968258d19085a8cf

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\metaphysic\possessively.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\users\public\mercifulHaddock.txt DrawThemeIcon
      2⤵
        PID:1716

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1752-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

            Filesize

            8KB

          • memory/1752-55-0x000007FEF31B0000-0x000007FEF3BD3000-memory.dmp

            Filesize

            10.1MB

          • memory/1752-56-0x000007FEF2650000-0x000007FEF31AD000-memory.dmp

            Filesize

            11.4MB

          • memory/1752-57-0x000000001B830000-0x000000001BB2F000-memory.dmp

            Filesize

            3.0MB

          • memory/1752-58-0x0000000002484000-0x0000000002487000-memory.dmp

            Filesize

            12KB

          • memory/1752-59-0x000000000248B000-0x00000000024AA000-memory.dmp

            Filesize

            124KB

          • memory/1752-61-0x0000000002484000-0x0000000002487000-memory.dmp

            Filesize

            12KB

          • memory/1752-62-0x000000000248B000-0x00000000024AA000-memory.dmp

            Filesize

            124KB