1a59f2492b5b15c0678e6134d6ec4df38c45de5555767463cf9590bfdb1fdda8 | Triage

Analysis

max time kernel
147s
max time network
141s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 13:06

Sharing

Report Analysis Logs

General

Target

ROLLY 3Y23RY4R2.exe
Size

836KB
MD5

4e1530c6b967dd7d25fed0be9112dd2f
SHA1

ed8902a013ffb305e901bc7cc0b1d8cbbf7cf7cf
SHA256

1a59f2492b5b15c0678e6134d6ec4df38c45de5555767463cf9590bfdb1fdda8
SHA512

4e06f5ec5f6911d8eb5948afc5598d61bf810feea4b2a17dd28ce0f9605524918a5cbc3a5baf3135955b1e0f1004a87e97fd0226753f0dd2690fade66e09e173

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2220 3768 WerFault.exe ROLLY 3Y23RY4R2.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2220 WerFault.exe
Token: SeBackupPrivilege 2220 WerFault.exe
Token: SeDebugPrivilege 2220 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ROLLY 3Y23RY4R2.exe
"C:\Users\Admin\AppData\Local\Temp\ROLLY 3Y23RY4R2.exe"
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 900
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x00000000046F0000-0x00000000046F1000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x00000000046F0000-0x00000000046F1000-memory.dmp

Filesize
4KB

Download
memory/2220-3-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download