47e5d3ce3db665ba1bd95863dedaebfc2c837f6e70747a614408451c50b7d564 | Triage

Analysis

max time kernel
137s
max time network
140s
platform
windows10_x64
resource
win10
submitted
07-07-2020 06:06

Sharing

Report Analysis Logs

General

Target

Nuevo orden.exe
Size

553KB
MD5

ebaedfa3c71e93c64c4e3c9ab87deace
SHA1

e692d48f36b3704cdc2d5ee07173bd6b3b7a3b7d
SHA256

47e5d3ce3db665ba1bd95863dedaebfc2c837f6e70747a614408451c50b7d564
SHA512

d241e0878e04a007ded70d20b61e03d6dd6d3778ad333ede91d6dfcfce2bbe4c5a5cb3cab663bd9c97a0265c9fd56deec68a66bad0c8368c816dc5b19fd353ef

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3940 3588 WerFault.exe Nuevo orden.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3940 WerFault.exe
Token: SeBackupPrivilege 3940 WerFault.exe
Token: SeDebugPrivilege 3940 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Nuevo orden.exe
"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/3940-1-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download