f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068 | Triage

Analysis

max time kernel
128s
max time network
128s
platform
windows10_x64
resource
win10v200430
submitted
29-05-2020 11:12

Sharing

Report Analysis Logs

General

Target

f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068.exe
Size

663KB
MD5

33b1f895b3905d4591207565ebfefef4
SHA1

95dd25f7e36c18e90f5920d151fb808368fe3e12
SHA256

f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068
SHA512

0102f1ec855b09a20064a2a1983e7347b0a65b5440a08ab1d377429fb033bb984c67e50d460951054901c023716b62f2aa1ab149493c9dc134782abb7fa87bbb

Score

5^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe

Drops file in System32 directory 1 IoCs

Processes:

f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2528 3216 WerFault.exe f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2528 WerFault.exe
Token: SeBackupPrivilege 2528 WerFault.exe
Token: SeDebugPrivilege 2528 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068.exe
"C:\Users\Admin\AppData\Local\Temp\f6d53e15abbb9743eabf99eb208843494ba8092d426e253ff96bf00b6271c068.exe"
1⤵
- Drops file in System32 directory
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 856
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-0-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download