0d07c8344ef01c56baf0fbb085a23d8ebce502082ae9461bfd60fd38ea10f829 | Triage

Analysis

max time kernel
145s
max time network
145s
platform
windows10_x64
resource
win10
submitted
08-07-2020 16:49

Sharing

Report Analysis Logs

General

Target

RFQ Order Diagram.exe
Size

893KB
MD5

d2b3ddebd7c42a7fef79345d88662ea3
SHA1

4f41f4fe60b7c2cd6efefc319777c53d08208277
SHA256

0d07c8344ef01c56baf0fbb085a23d8ebce502082ae9461bfd60fd38ea10f829
SHA512

16205aec18105a2d0ca8bdab9dcad8a30b8ac16bdda2885ee10e2e5a2ec123a872a43867623bbf3a92f191d37a4c84076bc38b2e06fe073a48eb36e7b6c7ecab

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3840 2460 WerFault.exe RFQ Order Diagram.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe
3840	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3840 WerFault.exe
Token: SeBackupPrivilege 3840 WerFault.exe
Token: SeDebugPrivilege 3840 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ Order Diagram.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ Order Diagram.exe"
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1148
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-0-0x0000000004360000-0x0000000004361000-memory.dmp

Filesize
4KB

Download
memory/3840-1-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download
memory/3840-2-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download