fe3d080d4f87330a9c483bef058dccec56ec8926d4042b90f05e8640e49a0c31 | Triage™

Analysis

max time kernel
63s
max time network
67s
platform
windows10_x64
resource
win10v200430
submitted
01/07/2020, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
745876976Order98867.exe
Size 658KB
Sample200701-5314kafff6
SHA256 fe3d080d4f87330a9c483bef058dccec56ec8926d4042b90f05e8640e49a0c31
MD5 4d97d0e5c78b79da3bea11d445b29cf2
SHA1 387b2794739426404b28555fb5c615784bc2ec32
SHA512 737c6e4cc260d450c378785d4ad143199aca13f8a483a255b2c0df0671c1aa3916f61053af88fa096ed017727328e8f91de74ed5daa7aa184aef88e5b2025cfa
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
420	1008	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1008	745876976Order98867.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	745876976Order98867.exe
Token: SeRestorePrivilege	420	WerFault.exe
Token: SeBackupPrivilege	420	WerFault.exe
Token: SeDebugPrivilege	420	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\745876976Order98867.exe
"C:\Users\Admin\AppData\Local\Temp\745876976Order98867.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 960
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/420-0-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Download

memory/420-1-0x00000000053F0000-0x00000000053F1000-memory.dmp

Download