c729fe749d29e3dc9ebfc56c96f7bc99544df5b09bff25e47a57a3bc9bbc3183 | Triage

Analysis

max time kernel
135s
max time network
136s
platform
windows10_x64
resource
win10
submitted
30-06-2020 12:14

Sharing

Report Analysis Logs

General

Target

INV & PL FOR CONTAINER#MRKU0425288.exe
Size

400KB
MD5

2a6991b86ef3ddb7e0807f2bc3375d29
SHA1

c6aaeb91edde96bda59a6dc23e691c92a56542f6
SHA256

c729fe749d29e3dc9ebfc56c96f7bc99544df5b09bff25e47a57a3bc9bbc3183
SHA512

49c6877a7ed87e6b5523a80fe3824e57dcde5102867115213f7200798e2eb30041436b7af5a1e37aef773b57cb97366e7c1526b884fa3241f6ddaac9a27cac8f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3864 3676 WerFault.exe INV & PL FOR CONTAINER#MRKU0425288.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3864 WerFault.exe
Token: SeBackupPrivilege 3864 WerFault.exe
Token: SeDebugPrivilege 3864 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\INV & PL FOR CONTAINER#MRKU0425288.exe
"C:\Users\Admin\AppData\Local\Temp\INV & PL FOR CONTAINER#MRKU0425288.exe"
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 892
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3864-0-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/3864-1-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download