8463a584e6cc9d88c4971255edb22b51b3b89a8b87fce207b80d1adf61d5fcce | Triage

Analysis

max time kernel
77s
max time network
121s
platform
windows10_x64
resource
win10
submitted
07-07-2020 06:27

Sharing

Report Analysis Logs

General

Target

payment invoice.exe
Size

296KB
MD5

630ff7654144a9486c7553548b5c2b9c
SHA1

74ef29a37e96cedaadd988cd7d157f844b90f611
SHA256

8463a584e6cc9d88c4971255edb22b51b3b89a8b87fce207b80d1adf61d5fcce
SHA512

e833916257f1162c716922813b7aff0e942a7ec47fd9447e12757e24044c3db15cded443b0e7e1e98339ad3b4154c8818fdc73efd7c57c69fb71c935bc638ecb

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3816 WerFault.exe
Token: SeBackupPrivilege 3816 WerFault.exe
Token: SeDebugPrivilege 3816 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3816 2896 WerFault.exe payment invoice.exe

C:\Users\Admin\AppData\Local\Temp\payment invoice.exe
"C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 880
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-0-0x00000000041A0000-0x00000000041A1000-memory.dmp

Filesize
4KB

Download