68a9e2865afa7d982775ae96d054e37d6931f5cd79ff45841526bba1b6e285ae | Triage™

Analysis

max time kernel
144s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
07/07/2020, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document_BT24PDF.exe
Size 708KB
Sample200707-ntez7bpp3e
SHA256 68a9e2865afa7d982775ae96d054e37d6931f5cd79ff45841526bba1b6e285ae
MD5 24dfb53577948ba7815cf68c40faaac6
SHA1 9eeee3569616d5f1ecf9ebbd288f1f635b4819b9
SHA512 717e6eb6c4d07ed2eb6f2f44cc0641cb012ed532789d87b01e3f34491928bd400acf63cb1806a6063d5250a76ca919c21ebe2a09f3f0f572387c7cba559f0e73
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
656	3824	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3824	Document_BT24PDF.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	Document_BT24PDF.exe
Token: SeRestorePrivilege	656	WerFault.exe
Token: SeBackupPrivilege	656	WerFault.exe
Token: SeDebugPrivilege	656	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 940
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-0-0x00000000044D0000-0x00000000044D1000-memory.dmp

Download

memory/656-1-0x0000000004C90000-0x0000000004C91000-memory.dmp

Download