73a4e945a1c898ac6a48f8359785c4bd85a1e9af7423db4bd18149c428503cb2 | Triage

Analysis

max time kernel
86s
max time network
98s
platform
windows10_x64
resource
win10
submitted
07-07-2020 10:02

Sharing

Report Analysis Logs

General

Target

DHL-#AWB130501923096.pdf.exe
Size

568KB
MD5

b70d92034cfc3f3015f270e306d6a1e5
SHA1

5281550bb31582b06cde9c9cbf11ba4c98fc1d03
SHA256

73a4e945a1c898ac6a48f8359785c4bd85a1e9af7423db4bd18149c428503cb2
SHA512

a17a0338f2789b04ad95afe7a4f80c1e812d8009376e2788da626dfe26a5f8bca17d115047cae30ccdee856968995ec22ec767fead8ed6bb2dc12531fb7cc51f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3856 3676 WerFault.exe DHL-#AWB130501923096.pdf.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3856 WerFault.exe
Token: SeBackupPrivilege 3856 WerFault.exe
Token: SeDebugPrivilege 3856 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL-#AWB130501923096.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL-#AWB130501923096.pdf.exe"
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3856-1-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download