Overview
overview
10Static
static
AFL27.iso
windows7-x64
3AFL27.iso
windows10-2004-x64
3AS.js
windows7-x64
10AS.js
windows10-2004-x64
10peseta/data.txt
windows7-x64
1peseta/data.txt
windows10-2004-x64
1peseta/flours.js
windows7-x64
3peseta/flours.js
windows10-2004-x64
7peseta/gratiae.ps1
windows7-x64
1peseta/gratiae.ps1
windows10-2004-x64
1peseta/opalescent.jpg
windows7-x64
3peseta/opalescent.jpg
windows10-2004-x64
3Analysis
-
max time kernel
72s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2023 21:04
Static task
static1
Behavioral task
behavioral1
Sample
AFL27.iso
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
AFL27.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
AS.js
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
AS.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
peseta/data.txt
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
peseta/data.txt
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
peseta/flours.js
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
peseta/flours.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
peseta/gratiae.ps1
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
peseta/gratiae.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
peseta/opalescent.jpg
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
peseta/opalescent.jpg
Resource
win10v2004-20221111-en
General
-
Target
peseta/gratiae.ps1
-
Size
367B
-
MD5
5479e1a9617b0222d0a8f001c63fb23b
-
SHA1
0c5428239a418c8586d1699adafeb2bddb0f8c95
-
SHA256
e6f4fe47c6e08c3b995b5e69efee09a853426607d64715bb1cf215640f785d58
-
SHA512
7bc5e090fbabd4746c1a075ed4d7bbfbdb4e0a235ff8c1be5e8257d5daf4f3e22a3f04d25d21108446a684cc7371eea6882d3c1d855a3c12e868a2e8d01d4ffa
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4612 powershell.exe 4612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4612 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
powershell.exedescription pid process target process PID 4612 wrote to memory of 4400 4612 powershell.exe rundll32.exe PID 4612 wrote to memory of 4400 4612 powershell.exe rundll32.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\peseta\gratiae.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\users\public\test1.txt DrawThemeIcon2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4400-134-0x0000000000000000-mapping.dmp
-
memory/4612-132-0x000001E6FB3B0000-0x000001E6FB3D2000-memory.dmpFilesize
136KB
-
memory/4612-133-0x00007FFEA5C90000-0x00007FFEA6751000-memory.dmpFilesize
10.8MB
-
memory/4612-135-0x00007FFEA5C90000-0x00007FFEA6751000-memory.dmpFilesize
10.8MB