Analysis
- max time kernel
132s - max time network
132s - platform
windows10_x64 - resource
win10 - submitted
02/07/2020, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
millenniumbcp-banco.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
millenniumbcp-banco.exe
Resource
win10
0 signatures
0 seconds
General
- Target millenniumbcp-banco.exe
- Size 613KB
- Sample200702-w33csa648x
- SHA256 39ccd0e238c32ee8643fa25aa7b27f77ca8e20d831d666c301c0f9a4063656b5
- MD5 12f308ff12631562dd0abf6cae79c168
- SHA1 ed68f2e8e35e6c908233f37c5d0637f96d0febc1
- SHA512 2e9398042275156f8a7741d122cf30000809de543c4a6ec1ace9c2638dea9cd91dd8413d2a6e763dd8954f5af4de78022b8375510d71e3b4d9becc4f51a8a9f4
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 3688 792 WerFault.exe 65 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3688 WerFault.exe Token: SeBackupPrivilege 3688 WerFault.exe Token: SeDebugPrivilege 3688 WerFault.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\millenniumbcp-banco.exe"C:\Users\Admin\AppData\Local\Temp\millenniumbcp-banco.exe"1⤵PID:792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 11042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3688
-