c897bb6c238b8990b86fd2c2a543b631e1cde061033da452c02d8037c6a19fe1 | Triage

Analysis

max time kernel
137s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
08/07/2020, 12:53

Sharing

Report Analysis Logs

General

Target

Invoice00846.pif.exe
Size

879KB
MD5

2946020f2dc046aceff16b15d84d5122
SHA1

3e6c8a4d954923a608e3b4a6a02e6f6b010cb32e
SHA256

c897bb6c238b8990b86fd2c2a543b631e1cde061033da452c02d8037c6a19fe1
SHA512

c4f91e5302d0f00973a923102c58a66e7db9fb694904e6a19b3616b292f89602f51d69d7a622d81a64739a669d0824afb8e60f3a0992e09226465e6d14377821

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	652	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2816	WerFault.exe
Token: SeBackupPrivilege	2816	WerFault.exe
Token: SeDebugPrivilege	2816	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Invoice00846.pif.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice00846.pif.exe"
1⤵
PID:652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-0-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/2816-1-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download