c6dc66a444215d6221e09e8fd68ae3a28eacf55f8de8462fb975c235304d7c4b | Triage

Analysis

max time kernel
145s
max time network
147s
platform
windows10_x64
resource
win10
submitted
02-07-2020 13:27

Sharing

Report Analysis Logs

General

Target

TW200064 PO#13979 TW200301 TW200315 TW200170.exe
Size

535KB
MD5

3c2858806e45c62ae13e74b264ad352a
SHA1

2e226b15ba97c79bee76ecc1ee831a32be9d75c8
SHA256

c6dc66a444215d6221e09e8fd68ae3a28eacf55f8de8462fb975c235304d7c4b
SHA512

f6d7f32d622ace9bb243b1dec7b8fef6fa31a40e40d0f9b4c2271c0c02c2ab83d16bc69d0971e9937ed32667bfe0bb1981e3f0764102ca5361a4e879f9d04523

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 736 WerFault.exe
Token: SeBackupPrivilege 736 WerFault.exe
Token: SeDebugPrivilege 736 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe
736	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

736 3356 WerFault.exe TW200064 PO#13979 TW200301 TW200315 TW200170.exe

C:\Users\Admin\AppData\Local\Temp\TW200064 PO#13979 TW200301 TW200315 TW200170.exe
"C:\Users\Admin\AppData\Local\Temp\TW200064 PO#13979 TW200301 TW200315 TW200170.exe"
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1096
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-0-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/736-2-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download