Analysis
-
max time kernel
75s -
max time network
119s -
platform
windows10_x64 -
resource
win10 -
submitted
08-07-2020 06:17
Static task
static1
Behavioral task
behavioral1
Sample
payment details.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
payment details.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
payment details.exe
-
Size
659KB
-
MD5
5fec9fd6977ba4a9ab185ca038431c32
-
SHA1
e6eaf725a02caaa5caeaffc2c945fb627719f427
-
SHA256
409e0c552b193d1bc80d97035d6c8aac94825f0c95b29ee596303b0d314eddba
-
SHA512
05d408f55a6834bd37c7e181985a9adc5863e049a84742c2b24c9087cede3221d485eae1fa56e9e03c407deac5ed42175e59162936d71ced34f7879af2370df6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3832 3100 WerFault.exe payment details.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
payment details.exeWerFault.exepid process 3100 payment details.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
payment details.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3100 payment details.exe Token: SeRestorePrivilege 3832 WerFault.exe Token: SeBackupPrivilege 3832 WerFault.exe Token: SeDebugPrivilege 3832 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment details.exe"C:\Users\Admin\AppData\Local\Temp\payment details.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 9362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832