f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663 | Triage

Analysis

max time kernel
124s
max time network
146s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 20:15

Sharing

Report Analysis Logs

General

Target

FedexTrackingClearanceInformation_PDF.exe
Size

2.1MB
MD5

49ed9fd1bfe4e4d685f014084d3b11b4
SHA1

ad9aa4dedddcd8de2d2fab04344d8f26c165537d
SHA256

f3de338bdde024a21dc1e987f41930a1b8ff9799adbab67f2345e8e648e81663
SHA512

b3ec6eae21e84345c98162c79cdd5527b14524855e1d0b8f95e599ab49f47c51aca34965446d4b6a8c93217739a7bf7fa7de19e077ad117747ab29d030bf0466

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

FedexTrackingClearanceInformation_PDF.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2536	FedexTrackingClearanceInformation_PDF.exe
Token: SeRestorePrivilege	1444	WerFault.exe
Token: SeBackupPrivilege	1444	WerFault.exe
Token: SeDebugPrivilege	1444	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

FedexTrackingClearanceInformation_PDF.exeWerFault.exe

pid	process
2536	FedexTrackingClearanceInformation_PDF.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1444 2536 WerFault.exe FedexTrackingClearanceInformation_PDF.exe

C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\FedexTrackingClearanceInformation_PDF.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 944
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-0-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/1444-1-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/1444-3-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download