55955f17d34267da959cd050b9f399df33c7ef7da0cbce05a74e98d90c2d2b3e | Triage

Analysis

max time kernel
146s
max time network
68s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 12:39

Sharing

Report Analysis Logs

General

Target

FT20178L5354.exe
Size

478KB
MD5

362e28ebdc3fe429b571764611c1885a
SHA1

d51fa7919a8a7f7ceaf8d26d0611b6f343538338
SHA256

55955f17d34267da959cd050b9f399df33c7ef7da0cbce05a74e98d90c2d2b3e
SHA512

1733bef1e41c89715316022959fa1a4f554fa981ac8963bc9ed05488f03ebb64ffea10b38e29a4aff370e95cc75cf2efe1e078cdac914705d008e079246c7bb4

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 676 WerFault.exe
Token: SeBackupPrivilege 676 WerFault.exe
Token: SeDebugPrivilege 676 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe
676	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

676 3544 WerFault.exe FT20178L5354.exe

C:\Users\Admin\AppData\Local\Temp\FT20178L5354.exe
"C:\Users\Admin\AppData\Local\Temp\FT20178L5354.exe"
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1140
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-0-0x0000000004190000-0x0000000004191000-memory.dmp

Filesize
4KB

Download
memory/676-1-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download