50823ae6e2e1cdf7aeb3fa1e9398ef0f5f7c244d22e3a1fce261aa0836bd02bd | Triage

Analysis

max time kernel
124s
max time network
146s
platform
windows10_x64
resource
win10v200430
submitted
07/07/2020, 09:50

Sharing

Report Analysis Logs

General

Target

Attached Documents FYV#07072020_pdf.exe
Size

371KB
MD5

b5de70712b8019f5209ea76c30d8874a
SHA1

cf50c5c5ec01f992ce869f6f564d355426f81ec0
SHA256

50823ae6e2e1cdf7aeb3fa1e9398ef0f5f7c244d22e3a1fce261aa0836bd02bd
SHA512

872324c5e4e701be10af8c6f392578b5b5d8e5166ba068d5c5553e0cd899835e443c6377d747601b269b066bded5896fec3d2aeadca1f76add2cb73f51849886

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2592	WerFault.exe
Token: SeBackupPrivilege	2592	WerFault.exe
Token: SeDebugPrivilege	2592	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe
2592	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	2536	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\Attached Documents FYV#07072020_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Attached Documents FYV#07072020_pdf.exe"
1⤵
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 944
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2592-0-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/2592-2-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download