7f511f157c4e3d413f1c71248bcf9abcc59edf12715db9e031270ae7acb0eb67 | Triage™

Analysis

max time kernel
65s
max time network
68s
platform
windows10_x64
resource
win10v200430
submitted
03/07/2020, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tracking No_SINI0068206497.exe
Size 699KB
Sample200703-ft665prywa
SHA256 7f511f157c4e3d413f1c71248bcf9abcc59edf12715db9e031270ae7acb0eb67
MD5 59fbd659300dd9df3b3b8846c99fc6b0
SHA1 35ac673d492ecd885837e4dfdccc5ad62aa94711
SHA512 eebc96d89c8304890a182135f3fd20ca996d5d5c384c9d6087408b4ee00fc972138c3af322c63e43c4f60b97fc888166387a01524841fc0e14a448f03e6ac795
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	3136	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3136	Tracking No_SINI0068206497.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	Tracking No_SINI0068206497.exe
Token: SeRestorePrivilege	856	WerFault.exe
Token: SeBackupPrivilege	856	WerFault.exe
Token: SeDebugPrivilege	856	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe
"C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 964
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-0-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/856-1-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download