d9019cb11445834f1406f08551653edc2f6f06caa32dfbf640e422c77a93f5f7 | Triage

Analysis

max time kernel
136s
max time network
103s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 12:50

Sharing

Report Analysis Logs

General

Target

SWIFT-103 001MTT191667524-html.exe
Size

300KB
MD5

a1c2e9091420d1e6de9873aeedcac17c
SHA1

315942ed654df55da5345e4eaac17317eb285671
SHA256

d9019cb11445834f1406f08551653edc2f6f06caa32dfbf640e422c77a93f5f7
SHA512

7cc8b07177c3fb8692c9aef6c8f6d611a60c152b248008023c4e158c3818c79fc441c1969a0b94155781f91eed382dde0041bb285ba4793e6314dc3ffb3e46cc

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe
3992	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3992 3944 WerFault.exe SWIFT-103 001MTT191667524-html.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3992 WerFault.exe
Token: SeBackupPrivilege 3992 WerFault.exe
Token: SeDebugPrivilege 3992 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT-103 001MTT191667524-html.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT-103 001MTT191667524-html.exe"
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1132
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3992-0-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/3992-1-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/3992-2-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download