f30ee3780bafae722faf43979da52a7657e0afa59f5621f50df938cb7a61316f | Triage

Analysis

max time kernel
132s
max time network
141s
platform
windows10_x64
resource
win10
submitted
07-07-2020 09:32

Sharing

Report Analysis Logs

General

Target

Attached New Order.exe
Size

566KB
MD5

53c74b55107cc7a08260559c256a4ca6
SHA1

01317b20e309e66356ae67e375d4d261ea0e597d
SHA256

f30ee3780bafae722faf43979da52a7657e0afa59f5621f50df938cb7a61316f
SHA512

9e64114d2790099d51debf2a4504148ae375f6d4240c68f80b40c8a79d259c5d55c160105888b02a6830915b6e2a39d37f8b1df8b415f5631ec2ca2170fe05f7

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3940 WerFault.exe
Token: SeBackupPrivilege 3940 WerFault.exe
Token: SeDebugPrivilege 3940 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3940 3588 WerFault.exe Attached New Order.exe

C:\Users\Admin\AppData\Local\Temp\Attached New Order.exe
"C:\Users\Admin\AppData\Local\Temp\Attached New Order.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 936
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/3940-2-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download