d87c321887e33a1f90a29b21be81459835a725d9a056916b1cafaaacc06169f5 | Triage

Analysis

max time kernel
69s
max time network
120s
platform
windows10_x64
resource
win10
submitted
08-07-2020 16:50

Sharing

Report Analysis Logs

General

Target

Akbank Hesap Özetiniz.exe
Size

784KB
MD5

23afabf8de05352048a78d1bbc3ad46f
SHA1

622f907c7c517b301818224901aeec8392a1dabe
SHA256

d87c321887e33a1f90a29b21be81459835a725d9a056916b1cafaaacc06169f5
SHA512

495e318896f2db02f8d7fe8a100e5e760118d6ffb0f3aa5d6e9e1d0b1c22180679b749e48b9d6f8ea9fae4d051be7af7c64df469a4a23413ce560f913d1e4813

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3240 3100 WerFault.exe Akbank Hesap Özetiniz.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3240 WerFault.exe
Token: SeBackupPrivilege 3240 WerFault.exe
Token: SeDebugPrivilege 3240 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Akbank Hesap Özetiniz.exe
"C:\Users\Admin\AppData\Local\Temp\Akbank Hesap Özetiniz.exe"
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 1148
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3240-0-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/3240-1-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/3240-3-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download