7e4e3787ea483d0e2f39bc98c7d6ea968b8943eb1b10fa655b1ce7b757aa1fe5 | Triage

Analysis

max time kernel
74s
max time network
151s
platform
windows10_x64
resource
win10
submitted
30-06-2020 13:04

Sharing

Report Analysis Logs

General

Target

Tracking No_SINI0068206497.exe
Size

705KB
MD5

6976fb0f4f1938ccd9bb0a8092889658
SHA1

4039e72d3f28488387bb5beb92a3d00e3dbd5771
SHA256

7e4e3787ea483d0e2f39bc98c7d6ea968b8943eb1b10fa655b1ce7b757aa1fe5
SHA512

887ee590539adb705382f3365325f603ba9add7346343c368b1a097fadc2eca155336c5d899fbf3191c44a4edd0c5967ddfdc61c256b60a93939ef2881504f22

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3688 792 WerFault.exe Tracking No_SINI0068206497.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

Tracking No_SINI0068206497.exeWerFault.exe

pid	process
792	Tracking No_SINI0068206497.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Tracking No_SINI0068206497.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	792	Tracking No_SINI0068206497.exe
Token: SeRestorePrivilege	3688	WerFault.exe
Token: SeBackupPrivilege	3688	WerFault.exe
Token: SeDebugPrivilege	3688	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe
"C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 932
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3688-0-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3688-1-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download