ff28ee9468d1e2d7a55d7d1d619415f78866bc8d4ba179f9215a7145bccea044 | Triage™

Analysis

max time kernel
128s
max time network
110s
platform
windows10_x64
resource
win10v200430
submitted
24/06/2020, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lubrizol Corporation - products list.exe
Size 618KB
Sample200624-1tpbsb9ran
SHA256 ff28ee9468d1e2d7a55d7d1d619415f78866bc8d4ba179f9215a7145bccea044
MD5 6d2895ec61a76093bf070774fb459f44
SHA1 84d7a1ade58a713f52430b93d3c0850a0006ee00
SHA512 e21a17b0f6c734605f0fac19fdd1b04ada454cadf05f1ab3f926dcf237c25060fb9cf6e11380d3e97a4f48a39f39785547a0aea96bff8c0c75090a7a7a72b0dd
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1660	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2880	WerFault.exe
Token: SeBackupPrivilege	2880	WerFault.exe
Token: SeDebugPrivilege	2880	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Lubrizol Corporation - products list.exe
"C:\Users\Admin\AppData\Local\Temp\Lubrizol Corporation - products list.exe"
1⤵
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 904
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000004450000-0x0000000004451000-memory.dmp

Download