f7d1402eb35c67bfb9f0cdf77c4050fc40c936fc0034d8b86bdbd20deed76db0 | Triage

Analysis

max time kernel
144s
max time network
69s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 09:55

Sharing

Report Analysis Logs

General

Target

CAII000080521.exe
Size

1.2MB
MD5

017ecc0d306245e81566079ecf525be6
SHA1

aa2f5b1650a9d26aca637a3d9b72e94e9acbd244
SHA256

f7d1402eb35c67bfb9f0cdf77c4050fc40c936fc0034d8b86bdbd20deed76db0
SHA512

0c12c196b414356fa04f1772b1562d7d3eaee5787b52fe2cf8697ffa4b317319db57dd1f13ce768cca9f6ef9bfb62c908d4fc7f448cfd8432f8d1c883a3ac7d2

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

CAII000080521.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3824	CAII000080521.exe
Token: SeRestorePrivilege	656	WerFault.exe
Token: SeBackupPrivilege	656	WerFault.exe
Token: SeDebugPrivilege	656	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

CAII000080521.exeWerFault.exe

pid	process
3824	CAII000080521.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

656 3824 WerFault.exe CAII000080521.exe

C:\Users\Admin\AppData\Local\Temp\CAII000080521.exe
"C:\Users\Admin\AppData\Local\Temp\CAII000080521.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 948
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-0-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/656-1-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/656-4-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download