8a0dfa424d15f228b79cf8e773937af51dbf53251168b44afa554fd62db25f85 | Triage™

Analysis

max time kernel
138s
max time network
139s
platform
windows10_x64
resource
win10
submitted
24/06/2020, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
enquiry.pdf.exe
Size 606KB
Sample200624-6pr16ccea6
SHA256 8a0dfa424d15f228b79cf8e773937af51dbf53251168b44afa554fd62db25f85
MD5 9d355f5d51632dc72e23d6251db0a83f
SHA1 6e78062da1b1f8801cbcbc5c2a17d6a18dc99791
SHA512 32808a998ca49338d8cd3b29ff832619b760a88d0dc551727c0fb6e4f67598ed1d893a3fbcbc214bf6f6cbeee0676168678a05636be71f38534c3cbd268b7363
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	3056	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3056	enquiry.pdf.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	enquiry.pdf.exe
Token: SeRestorePrivilege	3948	WerFault.exe
Token: SeBackupPrivilege	3948	WerFault.exe
Token: SeDebugPrivilege	3948	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\enquiry.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\enquiry.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1028
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3948-0-0x00000000046F0000-0x00000000046F1000-memory.dmp

Download

memory/3948-1-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download