cfda045f26a8812b937f0f751b706f9cff8bddbee0759420265ba201cd694e12 | Triage

Analysis

max time kernel
139s
max time network
70s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 13:26

Sharing

Report Analysis Logs

General

Target

HARRY5.7.exe
Size

728KB
MD5

d1d81029d33d61f18a65b188bd8eb507
SHA1

87fe929ce269da0087ff96c5c83a1503eecc995f
SHA256

cfda045f26a8812b937f0f751b706f9cff8bddbee0759420265ba201cd694e12
SHA512

68b23f2b1d7931ae91323d9d68ba24020d03e1c9438dd52b0e9b11453bba04c90abd218077be6d4a80e6caa45a7a9981b8f786d5ce3ca47a08ae2b843fe01ef8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

588 3656 WerFault.exe HARRY5.7.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

HARRY5.7.exeWerFault.exe

pid	process
3656	HARRY5.7.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

HARRY5.7.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3656	HARRY5.7.exe
Token: SeRestorePrivilege	588	WerFault.exe
Token: SeBackupPrivilege	588	WerFault.exe
Token: SeDebugPrivilege	588	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\HARRY5.7.exe
"C:\Users\Admin\AppData\Local\Temp\HARRY5.7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-0-0x0000000004680000-0x0000000004681000-memory.dmp

Filesize
4KB

Download