05db614a0ac02360bf29b2cd1b980cd556adccaa1a6213a19907facfd531460a | Triage

Analysis

max time kernel
135s
max time network
131s
platform
windows10_x64
resource
win10
submitted
24-06-2020 13:14

Sharing

Report Analysis Logs

General

Target

Global marketing and trade - GMT_Attachment#20200624.exe
Size

660KB
MD5

608540b511fe0bc49993f62057037f76
SHA1

2a86995bb9463030b8b3a3bf6f68f2b5d0af3eb1
SHA256

05db614a0ac02360bf29b2cd1b980cd556adccaa1a6213a19907facfd531460a
SHA512

d0d258ba942421b0db844f0e200b9b7324a2b28047bccd3e584fa1654ab138a5a9fbec24c0fd438138e2f0b316a028c57f290b6b1a9c8fb5f8cdc7687d4d25ac

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3884 3104 WerFault.exe Global marketing and trade - GMT_Attachment#20200624.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe
3884	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3884 WerFault.exe
Token: SeBackupPrivilege 3884 WerFault.exe
Token: SeDebugPrivilege 3884 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Global marketing and trade - GMT_Attachment#20200624.exe
"C:\Users\Admin\AppData\Local\Temp\Global marketing and trade - GMT_Attachment#20200624.exe"
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1108
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3884-0-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/3884-2-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download