6ed74e9cef6afae8b19f79eb97ba9acb97de44a6cf3ddf5e247b43e317f65ef8 | Triage

Analysis

max time kernel
92s
max time network
98s
platform
windows10_x64
resource
win10
submitted
07-07-2020 12:44

Sharing

Report Analysis Logs

General

Target

New Order no.83.exe
Size

524KB
MD5

f56fd625a6f5432271de65d3874af2e0
SHA1

aed3bc9c6d6f6e805eba4730c1ebd96cc28a117e
SHA256

6ed74e9cef6afae8b19f79eb97ba9acb97de44a6cf3ddf5e247b43e317f65ef8
SHA512

838e457766ebf38b212db8383ceb653a4ce628cf9f357cd05ab1d3383069660e0c43f32d631b091e1e2c7c15e677f2f764826ad3b56d33a9a52c4b635ad5c5de

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3888 WerFault.exe
Token: SeBackupPrivilege 3888 WerFault.exe
Token: SeDebugPrivilege 3888 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3888 3892 WerFault.exe New Order no.83.exe

C:\Users\Admin\AppData\Local\Temp\New Order no.83.exe
"C:\Users\Admin\AppData\Local\Temp\New Order no.83.exe"
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 948
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3888-0-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/3888-1-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/3888-3-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download