862376a9e48e0c84820bfd7b013cb14f9e2a41151785f3558e7912e2e8041d39 | Triage

Analysis

max time kernel
65s
max time network
62s
platform
windows10_x64
resource
win10
submitted
30-06-2020 13:49

Sharing

Report Analysis Logs

General

Target

dhl_customers_form_pdf.exe
Size

1006KB
MD5

fd847645836a66a79e9158f45f863edd
SHA1

d2ea031d7928e421d57925c0e4108051d7d1d652
SHA256

862376a9e48e0c84820bfd7b013cb14f9e2a41151785f3558e7912e2e8041d39
SHA512

7374d9351f5e3940dfa63b9019275359ccf52666f182072624adb1ae60302e22bae2c66dd63107128cc63229a83f62dfb1afc648918836a50f56fb5cc2589999

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

dhl_customers_form_pdf.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3100	dhl_customers_form_pdf.exe
Token: SeRestorePrivilege	4028	WerFault.exe
Token: SeBackupPrivilege	4028	WerFault.exe
Token: SeDebugPrivilege	4028	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

dhl_customers_form_pdf.exeWerFault.exe

pid	process
3100	dhl_customers_form_pdf.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4028 3100 WerFault.exe dhl_customers_form_pdf.exe

C:\Users\Admin\AppData\Local\Temp\dhl_customers_form_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\dhl_customers_form_pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 964
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-0-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/4028-1-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download