Analysis
-
max time kernel
121s -
max time network
119s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 12:53
Static task
static1
Behavioral task
behavioral1
Sample
TT SLIP.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TT SLIP.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
TT SLIP.exe
-
Size
621KB
-
MD5
9be7ccf2784692c34f0a23ee1c6cdf96
-
SHA1
50893829429e45ae306e74499339fb4e71356bf6
-
SHA256
1783a9996138d2b199496d53340e7a68f0f265af553a4caabaaf5fe1ada46e3c
-
SHA512
8be8a31b093a0b5063c861233c92c6b8caac37ccdb7b3198e597cceeb720edd06dd818231d46af0effc987bd0b22048b58abcf2ca95ad3df7708a5d896cc6b7e
Score
3/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
TT SLIP.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4060 TT SLIP.exe Token: SeRestorePrivilege 3836 WerFault.exe Token: SeBackupPrivilege 3836 WerFault.exe Token: SeDebugPrivilege 3836 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
TT SLIP.exeWerFault.exepid process 4060 TT SLIP.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe 3836 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3836 4060 WerFault.exe TT SLIP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT SLIP.exe"C:\Users\Admin\AppData\Local\Temp\TT SLIP.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 9362⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash