05634115b645d0df04cd66ef32a3d4301fda48edb1750d87f404e1ba73b6be04 | Triage

Resubmissions

29-05-2020 14:54

200529-m8ej6tddre 10

19-05-2020 21:38

200519-bxf9fygjfx 7

Analysis

max time kernel
131s
max time network
70s
platform
windows10_x64
resource
win10v200430
submitted
29-05-2020 14:54

Sharing

Report Analysis Logs

General

Target

RjJZqTyRrEpvftP.exe
Size

863KB
MD5

95b6c2e6cfef73be03af6ec5a4c82be8
SHA1

de12d0b9c6141d48b5cf436446071b57cab750be
SHA256

05634115b645d0df04cd66ef32a3d4301fda48edb1750d87f404e1ba73b6be04
SHA512

339cb7d10389e45aa87b0e8e76a95662e4a7487e8585ba58c085956b0fde873ab068a6b4880d96f2641aaa4b8ef786516292f936386201846ed5e986f008604d

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2028 WerFault.exe
Token: SeBackupPrivilege 2028 WerFault.exe
Token: SeDebugPrivilege 2028 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1732 WerFault.exe RjJZqTyRrEpvftP.exe

C:\Users\Admin\AppData\Local\Temp\RjJZqTyRrEpvftP.exe
"C:\Users\Admin\AppData\Local\Temp\RjJZqTyRrEpvftP.exe"
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1096
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download