77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049 | Triage

Analysis

max time kernel
68s
max time network
96s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Company Info.exe
Size

1.0MB
MD5

49c568fb7de5bb77140ab3b40e54fdff
SHA1

6d74dbf23a857e11d9a30a28e2ebe7dc3b74735a
SHA256

77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049
SHA512

de918d8654df77256b5a7036c8c5e969605c2744e160b58cb5bd86e0abcf691c9f55bff43299b3149152ce5c02191c9b8e56b4254dad7e9dea2c7dc7b41489de

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	3068	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1840	WerFault.exe
Token: SeBackupPrivilege	1840	WerFault.exe
Token: SeDebugPrivilege	1840	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Company Info.exe
"C:\Users\Admin\AppData\Local\Temp\Company Info.exe"
1⤵
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 936
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-0-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1840-1-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1840-4-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download