409e0c552b193d1bc80d97035d6c8aac94825f0c95b29ee596303b0d314eddba | Triage

Analysis

max time kernel
75s
max time network
119s
platform
windows10_x64
resource
win10
submitted
08-07-2020 06:17

Sharing

Report Analysis Logs

General

Target

payment details.exe
Size

659KB
MD5

5fec9fd6977ba4a9ab185ca038431c32
SHA1

e6eaf725a02caaa5caeaffc2c945fb627719f427
SHA256

409e0c552b193d1bc80d97035d6c8aac94825f0c95b29ee596303b0d314eddba
SHA512

05d408f55a6834bd37c7e181985a9adc5863e049a84742c2b24c9087cede3221d485eae1fa56e9e03c407deac5ed42175e59162936d71ced34f7879af2370df6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3832 3100 WerFault.exe payment details.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

payment details.exeWerFault.exe

pid	process
3100	payment details.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe
3832	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

payment details.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3100	payment details.exe
Token: SeRestorePrivilege	3832	WerFault.exe
Token: SeBackupPrivilege	3832	WerFault.exe
Token: SeDebugPrivilege	3832	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\payment details.exe
"C:\Users\Admin\AppData\Local\Temp\payment details.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3832-0-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/3832-1-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download