cfe3e39344160f0c067bbcb411a123e112df412019426aa3fc665ceb7c173f0e | Triage

Analysis

max time kernel
65s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
07/07/2020, 09:07

Sharing

Report Analysis Logs

General

Target

invois 002012001864 bertarikh 07072020.exe
Size

579KB
MD5

d662aab0cfa82462427ecf5131a40d87
SHA1

a03cc1baca5712b05999f83264106f4bcfee4395
SHA256

cfe3e39344160f0c067bbcb411a123e112df412019426aa3fc665ceb7c173f0e
SHA512

2772d9492e1c40ce2eb3cfbc6c330118b02f331b7ce5193f18c318b1eeb7c01df7c5e8df41ea1a554169972a00b139e2bcccc3c0da92a1a8438d1e22da1b2807

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2420	2564	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe
2420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2420	WerFault.exe
Token: SeBackupPrivilege	2420	WerFault.exe
Token: SeDebugPrivilege	2420	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\invois 002012001864 bertarikh 07072020.exe
"C:\Users\Admin\AppData\Local\Temp\invois 002012001864 bertarikh 07072020.exe"
1⤵
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 940
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/2420-3-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download