03ca4226a0ffde63bd99d756625c24269cf2f6f19ed5d701a5f4f0c6b1fd4ce9 | Triage

Analysis

max time kernel
62s
max time network
113s
platform
windows10_x64
resource
win10
submitted
30-06-2020 12:26

Sharing

Report Analysis Logs

General

Target

AMG-017-PR-2020.exe
Size

898KB
MD5

436957539bc3982ff1d55de1c0581647
SHA1

0f24979c7a7fe896272051ce7dc1df6d20e546bb
SHA256

03ca4226a0ffde63bd99d756625c24269cf2f6f19ed5d701a5f4f0c6b1fd4ce9
SHA512

95ac240b256ba8d11055e88ad7c41bdd7969f90f0ac5ff5ee6e40a4ce05933806d9aab4aae86be8ecbc2e7ed144752fd06b9c9460151b198ad643c009a52757e

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3788 WerFault.exe
Token: SeBackupPrivilege 3788 WerFault.exe
Token: SeDebugPrivilege 3788 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3788 3828 WerFault.exe AMG-017-PR-2020.exe

C:\Users\Admin\AppData\Local\Temp\AMG-017-PR-2020.exe
"C:\Users\Admin\AppData\Local\Temp\AMG-017-PR-2020.exe"
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1140
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3788-0-0x0000000004100000-0x0000000004101000-memory.dmp

Filesize
4KB

Download
memory/3788-1-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/3788-3-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download