a424b30d1dacb4ef13395109de5b43d2f8253942b2d521d5f6f78a129de4ce77 | Triage™

Analysis

max time kernel
126s
max time network
129s
platform
windows10_x64
resource
win10
submitted
03/07/2020, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New order.exe
Size 500KB
Sample200703-2ay97p3htx
SHA256 a424b30d1dacb4ef13395109de5b43d2f8253942b2d521d5f6f78a129de4ce77
MD5 4c4cdf53382fa24c1892eac66c7e4724
SHA1 cf22a1eaf17e0addf54b8dee33920bda95daeced
SHA512 b41343c8f5052aff72e31df5384d33f47bae57a7c6d0fb409e11c00f65e6e51eaeca66d0773c33d8a9df1a873ee9bb85c06bc125a32f6515ee73085b8a9efdac
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	384	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
384	New order.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	New order.exe
Token: SeRestorePrivilege	3796	WerFault.exe
Token: SeBackupPrivilege	3796	WerFault.exe
Token: SeDebugPrivilege	3796	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\New order.exe
"C:\Users\Admin\AppData\Local\Temp\New order.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 960
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3796-0-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/3796-2-0x0000000005240000-0x0000000005241000-memory.dmp

Download