702221e0753dc7bdae96ab782721c0e3a58d5d51d15f74af56c662f92f120125 | Triage

Analysis

max time kernel
142s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 18:29

Sharing

Report Analysis Logs

General

Target

MSIFF25.tmp.exe
Size

128KB
MD5

a6f7c0e5ca9c0851ca59d54ef99d49ce
SHA1

1f8b93a7abc52fe39f26458d93554f4d425e3024
SHA256

702221e0753dc7bdae96ab782721c0e3a58d5d51d15f74af56c662f92f120125
SHA512

e0380ed25c10d3898c70876867b3789b052439e47f447ec2fdb55f4f4b87fdb2a37cfac274c511881952b3be9307d83f1b48f89f2215d44e04459988d384b425

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe
1240	WerFault.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	MSIFF25.tmp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 428	4004	MSIFF25.tmp.exe	66
PID 4004 wrote to memory of 428	4004	MSIFF25.tmp.exe	66
PID 4004 wrote to memory of 428	4004	MSIFF25.tmp.exe	66
PID 428 wrote to memory of 3196	428	WScript.exe	67
PID 428 wrote to memory of 3196	428	WScript.exe	67
PID 428 wrote to memory of 3196	428	WScript.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	3196	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1240	WerFault.exe
Token: SeBackupPrivilege	1240	WerFault.exe
Token: SeDebugPrivilege	1240	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MSIFF25.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\MSIFF25.tmp.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\microsoft.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('AppData')+'\microsoft.vbs',[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\RarSFX0\microsoft.vbs'));wscript 'C:\Users\Admin\AppData\Roaming\microsoft.vbs'"
    3⤵
    PID:3196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 704
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-9-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/1240-10-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/1240-17-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download