d1c9b6cc284f964d7a65df78137c404f2d24562354681f64433c7e2f25e30588 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows10_x64
resource
win10
submitted
07-07-2020 09:23

Sharing

Report Analysis Logs

General

Target

order details.EXCEL.XLSx.xls.io.exe
Size

359KB
MD5

140e89a0319fc70aa12f5523cb2df432
SHA1

b08e8aca4dd650de5ef73f13ebc3eba71da12655
SHA256

d1c9b6cc284f964d7a65df78137c404f2d24562354681f64433c7e2f25e30588
SHA512

e8c4f988cbff65bebecd4bfcda3473a354f2dac1bf646dab930c08924d876a11b937004859800b5544f2de7c5a73a3771b8275a16540dca6c9c876afff846020

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3864	3676	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3864	WerFault.exe
Token: SeBackupPrivilege	3864	WerFault.exe
Token: SeDebugPrivilege	3864	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.io.exe
"C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.io.exe"
1⤵
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 940
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3864-0-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/3864-1-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3864-2-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download