bfa9a0bab235b2a77b36a878df785df6290165fc4eb1ee7b1ecac17301f16d4d | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows10_x64
resource
win10
submitted
24-06-2020 13:43

Sharing

Report Analysis Logs

General

Target

W393sInoO0lETwy.exe
Size

453KB
MD5

05bc8cd5ac88000ae8a77b04ec1535f7
SHA1

de8fcc855cae15e96bc11064cec6c605db173f6c
SHA256

bfa9a0bab235b2a77b36a878df785df6290165fc4eb1ee7b1ecac17301f16d4d
SHA512

104002f2e60012e1a378fe06dd57a19e34bf43383a87f0a8a9e9544e61a5af12beebd0b19d5593f80aa5ee2197fda1b85b863beafdbd9eb61bdbdfb34f3913c5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3936 2880 WerFault.exe W393sInoO0lETwy.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3936 WerFault.exe
Token: SeBackupPrivilege 3936 WerFault.exe
Token: SeDebugPrivilege 3936 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\W393sInoO0lETwy.exe
"C:\Users\Admin\AppData\Local\Temp\W393sInoO0lETwy.exe"
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1104
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3936-0-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/3936-1-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download