Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 09:23
Static task
static1
Behavioral task
behavioral1
Sample
order details.EXCEL.XLSx.xls.io.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
order details.EXCEL.XLSx.xls.io.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
order details.EXCEL.XLSx.xls.io.exe
-
Size
359KB
-
MD5
140e89a0319fc70aa12f5523cb2df432
-
SHA1
b08e8aca4dd650de5ef73f13ebc3eba71da12655
-
SHA256
d1c9b6cc284f964d7a65df78137c404f2d24562354681f64433c7e2f25e30588
-
SHA512
e8c4f988cbff65bebecd4bfcda3473a354f2dac1bf646dab930c08924d876a11b937004859800b5544f2de7c5a73a3771b8275a16540dca6c9c876afff846020
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3864 3676 WerFault.exe 66 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3864 WerFault.exe Token: SeBackupPrivilege 3864 WerFault.exe Token: SeDebugPrivilege 3864 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe 3864 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.io.exe"C:\Users\Admin\AppData\Local\Temp\order details.EXCEL.XLSx.xls.io.exe"1⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 9402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3864
-