9a461345aa76acd802aebd2426775b952f411c0c1def2ae141f23fe4a16b5e7c | Triage

Analysis

max time kernel
124s
max time network
147s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 11:33

Sharing

Report Analysis Logs

General

Target

SCAN_PO CTL209-026.exe
Size

839KB
MD5

0957144bc6ea160515c1bfd6c2faa6d5
SHA1

e06dfa469646bc8cc28207abe7c8cb8116ab77e6
SHA256

9a461345aa76acd802aebd2426775b952f411c0c1def2ae141f23fe4a16b5e7c
SHA512

15d4bcfe795bc5eadd2909427acfce5e713b2a0d4402aa0d88d49f8880298a2c12407ce8c5a1f23b84c6405ca14f2dbc30ae7c464d983563c1c5e9959e5a6010

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1444 3908 WerFault.exe SCAN_PO CTL209-026.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

SCAN_PO CTL209-026.exeWerFault.exe

pid	process
3908	SCAN_PO CTL209-026.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SCAN_PO CTL209-026.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3908	SCAN_PO CTL209-026.exe
Token: SeRestorePrivilege	1444	WerFault.exe
Token: SeBackupPrivilege	1444	WerFault.exe
Token: SeDebugPrivilege	1444	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SCAN_PO CTL209-026.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_PO CTL209-026.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 944
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-0-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/1444-1-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download