d90925abd9610142883883caec224f1fb3e467da1e0f43e7b6ebd256b9a2c2db | Triage

Analysis

max time kernel
135s
max time network
99s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 06:01

Sharing

Report Analysis Logs

General

Target

PROFORMA INVIOCE.PDF.exe
Size

561KB
MD5

5ece3812c8291e744b609ac1b051d1e3
SHA1

f4a0c12c5eff667f7fddbbb262da426c34bc6cce
SHA256

d90925abd9610142883883caec224f1fb3e467da1e0f43e7b6ebd256b9a2c2db
SHA512

efe4f33922a19e325dece0caa425f35bc7bec3bdd2141f15c869858f25f52c32ef7b2c081324c31f63e0091ad34705b7dbc06b10168a04befa5733ace3e9d418

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2152 1516 WerFault.exe PROFORMA INVIOCE.PDF.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2152 WerFault.exe
Token: SeBackupPrivilege 2152 WerFault.exe
Token: SeDebugPrivilege 2152 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PROFORMA INVIOCE.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVIOCE.PDF.exe"
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 944
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/2152-1-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download