b929c43ad6f3aefd59485197209608aee28ba2517eba13c2cdf2fe8c6a3d1d5d | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10
submitted
08-07-2020 16:52

Sharing

Report Analysis Logs

General

Target

Oustanding payment.exe
Size

1.1MB
MD5

e08e4eed875f9d63a180d0e637f3b548
SHA1

56222b109f96af4bc3db178f5a84ec9282553bb8
SHA256

b929c43ad6f3aefd59485197209608aee28ba2517eba13c2cdf2fe8c6a3d1d5d
SHA512

14f59f9d67d00259b90f45bf90ae4fe6bbab6a41e74e3705b8e033a8312ba838e478cda168cfa32ec09d75b6584e1f419647c4fa5911a05edab5c888073f7fc6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	3068	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1840	WerFault.exe
Token: SeBackupPrivilege	1840	WerFault.exe
Token: SeDebugPrivilege	1840	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Oustanding payment.exe
"C:\Users\Admin\AppData\Local\Temp\Oustanding payment.exe"
1⤵
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1144
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-0-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download