3fed11bcfa0ec80fa94626f65c9b397d2117782bc5efae636e3ee0462ca9e42d | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows10_x64
resource
win10
submitted
24-06-2020 13:14

Sharing

Report Analysis Logs

General

Target

Bank details.pdf.xlx.bat.exe
Size

458KB
MD5

cfe564351e6b4077a2408967ed77deec
SHA1

a2601f58f3659593da9c113b05a082d79b10cd73
SHA256

3fed11bcfa0ec80fa94626f65c9b397d2117782bc5efae636e3ee0462ca9e42d
SHA512

1ffcb47e15b9e373340820fcf2fb357bd61b8d7f407e2575a2944e65472264dbde235a83a403a988efb4e6b9cae4a01f2cac558790b12006bf71046db424b347

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3916 3104 WerFault.exe Bank details.pdf.xlx.bat.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3916 WerFault.exe
Token: SeBackupPrivilege 3916 WerFault.exe
Token: SeDebugPrivilege 3916 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Bank details.pdf.xlx.bat.exe
"C:\Users\Admin\AppData\Local\Temp\Bank details.pdf.xlx.bat.exe"
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1104
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3916-0-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/3916-1-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download