f51d5ea747751e28a14ea5c32a59d2b2af33bb91c402408312c1baa85054acb3 | Triage

Analysis

max time kernel
126s
max time network
151s
platform
windows10_x64
resource
win10v200430
submitted
08/07/2020, 06:06

Sharing

Report Analysis Logs

General

Target

overdue account letter.exe
Size

791KB
MD5

70c16d0855088ef43d81656b47332bba
SHA1

9d1a98abed89859a96fdfa0d1e40ad4fc63601a3
SHA256

f51d5ea747751e28a14ea5c32a59d2b2af33bb91c402408312c1baa85054acb3
SHA512

2c22c630c6b3bc8b63339b6e143f4c98921f8bbf6a31673bf7b85cd49789f2412dc067c2ec03a1c05a55b273468be354d2181353e151475b1c5e4388599e0596

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	1632	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe
2840	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2840	WerFault.exe
Token: SeBackupPrivilege	2840	WerFault.exe
Token: SeDebugPrivilege	2840	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\overdue account letter.exe
"C:\Users\Admin\AppData\Local\Temp\overdue account letter.exe"
1⤵
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 1160
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/2840-3-0x0000000005C20000-0x0000000005C21000-memory.dmp

Filesize
4KB

Download