b0cda517ace59b7d9be1d0dc49c2d85ff42fb780d86ee2623a206663486ed7c6 | Triage™

Analysis

max time kernel
145s
max time network
72s
platform
windows10_x64
resource
win10v200430
submitted
08/07/2020, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PaymentConfirmation.exe
Size 619KB
Sample200708-9r1mmbfc7e
SHA256 b0cda517ace59b7d9be1d0dc49c2d85ff42fb780d86ee2623a206663486ed7c6
MD5 74e728291a7d75a36e2ed4e9a0b1ff09
SHA1 d1f0f77cf48530c7f8b331ae42e996f369ad44bd
SHA512 93817b0cbfe095fd710883b4db7f0b160de00d01b62b015777a87a36d6052f834bac0f4894f44004aba5380bb346b7c7d2917f8ed49441889a61f87a4fd4bcef
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
656	3544	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3544	PaymentConfirmation.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe
656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	PaymentConfirmation.exe
Token: SeRestorePrivilege	656	WerFault.exe
Token: SeBackupPrivilege	656	WerFault.exe
Token: SeDebugPrivilege	656	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 940
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-0-0x0000000004920000-0x0000000004921000-memory.dmp

Download

memory/656-1-0x00000000050E0000-0x00000000050E1000-memory.dmp

Download