a66accde52c8f24dbd3d705a4babfee4015f547dc6f7a608cb6d37dd2930fccd | Triage

Analysis

max time kernel
64s
max time network
72s
platform
windows10_x64
resource
win10v200430
submitted
27-05-2020 13:47

Sharing

Report Analysis Logs

General

Target

20BHcKSmefo7MFF.exe
Size

396KB
MD5

f5714089e0fcf628ca4f885b24c5021a
SHA1

0405de4d982a3717948efab5e450c1d5d3cb4858
SHA256

a66accde52c8f24dbd3d705a4babfee4015f547dc6f7a608cb6d37dd2930fccd
SHA512

34e61ab8b440f897a6a39f21ae220ffa03ee3c4d4b2b2bbca9a1fdde8f51ba271f7b8c136434986644d5fb4749f0d2ab932379064d56b0d25786f2ad463ae660

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 916 WerFault.exe
Token: SeBackupPrivilege 916 WerFault.exe
Token: SeDebugPrivilege 916 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe
916	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

916 2556 WerFault.exe 20BHcKSmefo7MFF.exe

C:\Users\Admin\AppData\Local\Temp\20BHcKSmefo7MFF.exe
"C:\Users\Admin\AppData\Local\Temp\20BHcKSmefo7MFF.exe"
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 1168
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-0-0x0000000004180000-0x0000000004181000-memory.dmp

Filesize
4KB

Download
memory/916-1-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download