24b143878fdfd3d1fab8ce514132cbc304da8c6ff10e4cf91ab11028079a63a9 | Triage

Analysis

max time kernel
75s
max time network
137s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

customers_dhl-form.exe
Size

724KB
MD5

d3283503ee7554492851180b73796dae
SHA1

6224763d99acb1c3f0815302a7b22439284b90f1
SHA256

24b143878fdfd3d1fab8ce514132cbc304da8c6ff10e4cf91ab11028079a63a9
SHA512

7712fe167b039a4931a05c447113315c75a908811001913957c66273a53827573b28e7f9fa15b3c22266cabe22a611b029a58352e77100babedd3d39aa140fac

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	customers_dhl-form.exe
Token: SeRestorePrivilege	3812	WerFault.exe
Token: SeBackupPrivilege	3812	WerFault.exe
Token: SeDebugPrivilege	3812	WerFault.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2460	customers_dhl-form.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe
3812	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3812	2460	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\customers_dhl-form.exe
"C:\Users\Admin\AppData\Local\Temp\customers_dhl-form.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 940
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3812-0-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/3812-1-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download