b9a6dd35f9ca163d4e76a25d642ca7a580272ea7886a6a639273ac5b732e9f8c | Triage

Analysis

max time kernel
65s
max time network
110s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 08:25

Sharing

Report Analysis Logs

General

Target

RFQ # 097663899.exe
Size

517KB
MD5

c95c87c201c9378e1d9adb7037d2b7e7
SHA1

ff1f4a1123609ea18e9c65a5b36a4e536b40ae6a
SHA256

b9a6dd35f9ca163d4e76a25d642ca7a580272ea7886a6a639273ac5b732e9f8c
SHA512

b54ecc0039f89171dc059a007190125365c7aa08cea2e4f049d30993000ea81e6c3efb01c9880153b3b67e557090024b1fac8d7e5ee4e7dc1d7577a60a289b0a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3808	3588	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3808	WerFault.exe
Token: SeBackupPrivilege	3808	WerFault.exe
Token: SeDebugPrivilege	3808	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ # 097663899.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ # 097663899.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 936
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3808-0-0x0000000004220000-0x0000000004221000-memory.dmp

Filesize
4KB

Download
memory/3808-1-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download