4a0345609160627cbdc8b4ea076b1b755d9817e89f95d6ec8f6d51554c62d516 | Triage

Analysis

max time kernel
124s
max time network
146s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 12:03

Sharing

Report Analysis Logs

General

Target

PO#_30-06-2020_1051_0001.bat.exe
Size

435KB
MD5

5cabd28bcebd7545965402844c927d29
SHA1

289c5aaa099d079e9c72e70ebf0ea5221f1bada5
SHA256

4a0345609160627cbdc8b4ea076b1b755d9817e89f95d6ec8f6d51554c62d516
SHA512

c16d6c953a5d6b850c1ffd12b8d15f9fcc014dcc7b3ec6aa1fd9dddb3985115df390e6188d522b6a67446427a2ab3533545240e09d7cb4e16ee982ea051f2af4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2492 2536 WerFault.exe PO#_30-06-2020_1051_0001.bat.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2492 WerFault.exe
Token: SeBackupPrivilege 2492 WerFault.exe
Token: SeDebugPrivilege 2492 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO#_30-06-2020_1051_0001.bat.exe
"C:\Users\Admin\AppData\Local\Temp\PO#_30-06-2020_1051_0001.bat.exe"
1⤵
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 900
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-0-0x00000000045D0000-0x00000000045D1000-memory.dmp

Filesize
4KB

Download
memory/2492-1-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download