08c1f9f0755e45b664ec5cd4e5e44b895e204cd89c91fc59e5a218af5abc5779 | Triage

Analysis

max time kernel
141s
max time network
144s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 13:31

Sharing

Report Analysis Logs

General

Target

Order List_pdf.exe
Size

438KB
MD5

d402cd3dabdfbae88e6a5cb67acb00ef
SHA1

206ef592df35ca9d4c0d4f2d5ec9bc1c317d9cfe
SHA256

08c1f9f0755e45b664ec5cd4e5e44b895e204cd89c91fc59e5a218af5abc5779
SHA512

8e2a938fdc21259ddfa5ccfc03c3529537c6c14e4f6dd15cade2eb303f7e753276b26dddbad57382b2a653158eaf1e0cba03e1bbb9e4c9c4b86a2973fd40cabc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

900 3144 WerFault.exe Order List_pdf.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Order List_pdf.exeWerFault.exe

pid	process
3144	Order List_pdf.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Order List_pdf.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3144	Order List_pdf.exe
Token: SeRestorePrivilege	900	WerFault.exe
Token: SeBackupPrivilege	900	WerFault.exe
Token: SeDebugPrivilege	900	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order List_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order List_pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 928
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-0-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/900-1-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download