ad6a160f9fad0fefa2f7ffdd0e8b5c43f62bf8983b14443b4c33115592297663 | Triage

Analysis

max time kernel
61s
max time network
112s
platform
windows10_x64
resource
win10
submitted
30-06-2020 13:51

Sharing

Report Analysis Logs

General

Target

000102068976421xls.exe
Size

501KB
MD5

aca5a35b863484a94a66cb52273dbb36
SHA1

ba44b9c77293e2a50efde7be10e67301ee674dd3
SHA256

ad6a160f9fad0fefa2f7ffdd0e8b5c43f62bf8983b14443b4c33115592297663
SHA512

246029966efbdd70680f1f7339424922c69bd3afe80016d5fc958cd2608ae916366597e6c3b16e586c41ae33ba44fb5de9a5669dd6ffd81cde4cd1df1f2467e8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1376 364 WerFault.exe 000102068976421xls.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe
1376	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1376 WerFault.exe
Token: SeBackupPrivilege 1376 WerFault.exe
Token: SeDebugPrivilege 1376 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\000102068976421xls.exe
"C:\Users\Admin\AppData\Local\Temp\000102068976421xls.exe"
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 900
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-0-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/1376-1-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download