cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f | Triage

Analysis

max time kernel
135s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 10:22

Sharing

Report Analysis Logs

General

Target

INVOICE_Dubai6778899455.exe
Size

224KB
MD5

de8e255db63ba62ce08aafcada997a76
SHA1

d0c19ad11433c5528e6f4c46a34b271d34cfcef7
SHA256

cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f
SHA512

ff10b8b5d6117f689b8cbf9acb083d353407fadcc3351a5dba6fa44ca6b58967f30ce4bd8da1545fa8fbb6b226b7ed4e93725e5b3b5ef17fbb7539d0122d9d74

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2216 1516 WerFault.exe INVOICE_Dubai6778899455.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2216 WerFault.exe
Token: SeBackupPrivilege 2216 WerFault.exe
Token: SeDebugPrivilege 2216 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe
2216	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE_Dubai6778899455.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE_Dubai6778899455.exe"
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 936
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/2216-1-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download