abe23e12f4aa1f3e0b9ea3777ffaaf4fdcf9ccb21e7331b32d20bfa3a511f6c7 | Triage

Analysis

max time kernel
131s
max time network
133s
platform
windows10_x64
resource
win10
submitted
29-06-2020 12:45

Sharing

Report Analysis Logs

General

Target

#gfe00620.exe
Size

1.1MB
MD5

504fd653e392b36a4f829f583d8e5f29
SHA1

a5b27394da0c8afffbc4dfa4a734db62917b9fae
SHA256

abe23e12f4aa1f3e0b9ea3777ffaaf4fdcf9ccb21e7331b32d20bfa3a511f6c7
SHA512

e4c030d4a8e1693cb04158e4df28c51f916b4814bb4494c418248b861230a5ac6c55a41fbef46f3e7a0749b3d863850a37b2a8b5349a83a92b15fe394cf212ab

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3780 WerFault.exe
Token: SeBackupPrivilege 3780 WerFault.exe
Token: SeDebugPrivilege 3780 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3780 2920 WerFault.exe #gfe00620.exe

C:\Users\Admin\AppData\Local\Temp\#gfe00620.exe
"C:\Users\Admin\AppData\Local\Temp\#gfe00620.exe"
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1160
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3780-0-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/3780-1-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/3780-3-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download