ed75eccbb2a0ba07a7ec3524633b696416994678632e2fbade0be9bd178b973f | Triage

Analysis

max time kernel
129s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
07/07/2020, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

RFQ # 097663899..exe
Size

573KB
MD5

438764f5af1b92f873d00fdd5f5a8ecf
SHA1

72c4170e13a3217a98d1056208453166af718f32
SHA256

ed75eccbb2a0ba07a7ec3524633b696416994678632e2fbade0be9bd178b973f
SHA512

5f3c7160c1a5f1b2b0c2697b22dd6f422b03af5d259db8dff2ea8ae563cb8fca037c0f850fdc228a2f9bb5ec7053c3ac9504946ced4d98fb626f4a2597693ad2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	1504	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2660	WerFault.exe
Token: SeBackupPrivilege	2660	WerFault.exe
Token: SeDebugPrivilege	2660	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ # 097663899..exe
"C:\Users\Admin\AppData\Local\Temp\RFQ # 097663899..exe"
1⤵
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 944
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-0-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/2660-1-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/2660-2-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download