eea3d6de7952101ff57da6f48ea85ecdbaf71bf5027d0d20478021d842a21101 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows10_x64
resource
win10
submitted
30-06-2020 13:37

Sharing

Report Analysis Logs

General

Target

POs 097663899 NEW ORDER.r.exe
Size

399KB
MD5

610a2a3c8ff25649bb8d64f028d657fe
SHA1

939d2ffc7e123a061c3ecae244f618f2303c8d29
SHA256

eea3d6de7952101ff57da6f48ea85ecdbaf71bf5027d0d20478021d842a21101
SHA512

2d0ab260a7bb2a04a6bb40b68b8d67f8444eaee650d5204b1dd92b2541e4241085cb01e802a73c9d6bc41af33c1b7591b5736bcc0253c247964e2c53ed7c62ba

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4032 792 WerFault.exe POs 097663899 NEW ORDER.r.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe
4032	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4032 WerFault.exe
Token: SeBackupPrivilege 4032 WerFault.exe
Token: SeDebugPrivilege 4032 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe
"C:\Users\Admin\AppData\Local\Temp\POs 097663899 NEW ORDER.r.exe"
1⤵
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 892
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4032-0-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/4032-1-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download