5a6950daf886f38d5abd60f63c7a1aebec0b51dceaac314bd3818007a3ab3f09 | Triage

Analysis

max time kernel
65s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 09:31

Sharing

Report Analysis Logs

General

Target

20.07.07_rfq Specification.exe
Size

542KB
MD5

78447ae11a2552d9354c524d6ab09272
SHA1

9c065990e4146b2c6149a40135f21ec5ea3c5d74
SHA256

5a6950daf886f38d5abd60f63c7a1aebec0b51dceaac314bd3818007a3ab3f09
SHA512

b9839885f0d1333c38966c041a210ddac7e009409f746a231fb8f9cd2c9e525fcb65298382d2c962995960e1b3e72eca3f543e3866b4280b2f665e2e42db66c6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2828 3136 WerFault.exe 20.07.07_rfq Specification.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2828 WerFault.exe
Token: SeBackupPrivilege 2828 WerFault.exe
Token: SeDebugPrivilege 2828 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\20.07.07_rfq Specification.exe
"C:\Users\Admin\AppData\Local\Temp\20.07.07_rfq Specification.exe"
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 936
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/2828-1-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download