142a1fe1705fd25fd1add5f1e12e907a40465b51e3c1bd95b4afd7b00b08e232 | Triage

Analysis

max time kernel
130s
max time network
86s
platform
windows10_x64
resource
win10v200430
submitted
24-06-2020 13:14

Sharing

Report Analysis Logs

General

Target

666746643111.exe
Size

448KB
MD5

8b74de14057ed678f84ae6cee07a3ce9
SHA1

40201328a50849931a7d8bdfd8a229ae1790ad8d
SHA256

142a1fe1705fd25fd1add5f1e12e907a40465b51e3c1bd95b4afd7b00b08e232
SHA512

8a624e48118357ee0552d405678c64b04962c5af2d7e62298d542135da0c806638f3b5b01289849e3a2ee21db9ff1bb751d2636af2c8745330e1f5c35a648383

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2080 1472 WerFault.exe 666746643111.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2080 WerFault.exe
Token: SeBackupPrivilege 2080 WerFault.exe
Token: SeDebugPrivilege 2080 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\666746643111.exe
"C:\Users\Admin\AppData\Local\Temp\666746643111.exe"
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1108
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download