b0cda517ace59b7d9be1d0dc49c2d85ff42fb780d86ee2623a206663486ed7c6 | Triage

Analysis

max time kernel
145s
max time network
72s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 06:13

Sharing

Report Analysis Logs

General

Target

PaymentConfirmation.exe
Size

619KB
MD5

74e728291a7d75a36e2ed4e9a0b1ff09
SHA1

d1f0f77cf48530c7f8b331ae42e996f369ad44bd
SHA256

b0cda517ace59b7d9be1d0dc49c2d85ff42fb780d86ee2623a206663486ed7c6
SHA512

93817b0cbfe095fd710883b4db7f0b160de00d01b62b015777a87a36d6052f834bac0f4894f44004aba5380bb346b7c7d2917f8ed49441889a61f87a4fd4bcef

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

656 3544 WerFault.exe PaymentConfirmation.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

PaymentConfirmation.exeWerFault.exe

pid	process
3544	PaymentConfirmation.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PaymentConfirmation.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3544	PaymentConfirmation.exe
Token: SeRestorePrivilege	656	WerFault.exe
Token: SeBackupPrivilege	656	WerFault.exe
Token: SeDebugPrivilege	656	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 940
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-0-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/656-1-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download