68a9e2865afa7d982775ae96d054e37d6931f5cd79ff45841526bba1b6e285ae | Triage

Analysis

max time kernel
144s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 09:16

Sharing

Report Analysis Logs

General

Target

Document_BT24PDF.exe
Size

708KB
MD5

24dfb53577948ba7815cf68c40faaac6
SHA1

9eeee3569616d5f1ecf9ebbd288f1f635b4819b9
SHA256

68a9e2865afa7d982775ae96d054e37d6931f5cd79ff45841526bba1b6e285ae
SHA512

717e6eb6c4d07ed2eb6f2f44cc0641cb012ed532789d87b01e3f34491928bd400acf63cb1806a6063d5250a76ca919c21ebe2a09f3f0f572387c7cba559f0e73

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
656	3824	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3824	Document_BT24PDF.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	Document_BT24PDF.exe
Token: SeRestorePrivilege	656	WerFault.exe
Token: SeBackupPrivilege	656	WerFault.exe
Token: SeDebugPrivilege	656	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 940
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-0-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/656-1-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download