78cda73e2008c1ca39e0497d5065baf7404e4c6f943b7dab60b5eb6872c70098 | Triage

Analysis

max time kernel
149s
max time network
67s
platform
windows10_x64
resource
win10v200430
submitted
07/07/2020, 13:22

Sharing

Report Analysis Logs

General

Target

Order.exe
Size

686KB
MD5

73264b4a5cf35f2029d3ecd5f9ad5526
SHA1

50e13f20b9c5d3ba16dca9d44ff3cbe15b5065aa
SHA256

78cda73e2008c1ca39e0497d5065baf7404e4c6f943b7dab60b5eb6872c70098
SHA512

90ab76cc0ffdd6691d0be0c42dc27cc929345f806dfa281896072b6b75e59b4b34f85a1bac5e514264201a5267d869d83e4d8771010828ffa675d50bb7f4de01

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
504	3812	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3812	Order.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	Order.exe
Token: SeRestorePrivilege	504	WerFault.exe
Token: SeBackupPrivilege	504	WerFault.exe
Token: SeDebugPrivilege	504	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order.exe
"C:\Users\Admin\AppData\Local\Temp\Order.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 940
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-0-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/504-1-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/504-3-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download