c0a5e2237ef1901c7a3ee2c15290c8db625a1cb9659e99a86ee474460533aa32 | Triage

Analysis

max time kernel
136s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
08-06-2020 16:44

Sharing

Report Analysis Logs

General

Target

dsFqMLnEkvrogA9.exe
Size

398KB
MD5

f882b4b6a5a9a47e10244f70d661bd2e
SHA1

b77ef0dc1e64d6b396a2ac6f3a87ff3fd53ca503
SHA256

c0a5e2237ef1901c7a3ee2c15290c8db625a1cb9659e99a86ee474460533aa32
SHA512

a49b9b512d0f9a9afd81eeb7621543e6c5d4820a434f755218b7225a81f657371fe6e70fbe92ecdfcaf41e37c3efb894eb8ae8f38d4e4b14a632a7cc09599c38

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2068 WerFault.exe
Token: SeBackupPrivilege 2068 WerFault.exe
Token: SeDebugPrivilege 2068 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe
2068	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2068 1516 WerFault.exe dsFqMLnEkvrogA9.exe

C:\Users\Admin\AppData\Local\Temp\dsFqMLnEkvrogA9.exe
"C:\Users\Admin\AppData\Local\Temp\dsFqMLnEkvrogA9.exe"
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1172
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/2068-1-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/2068-2-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download