c890bc2e899bdb9c2a7cbe9ab52b852c5ea6832e44615f2afc66ab47925866d2 | Triage

Analysis

max time kernel
129s
max time network
69s
platform
windows10_x64
resource
win10v200430
submitted
08/07/2020, 06:51

Sharing

Report Analysis Logs

General

Target

UD_PO_000681.exe
Size

483KB
MD5

24a8d8c071bbb496ba8e64e7817fd6c9
SHA1

f40194270a9475aeb044a062bd7ef9376d8ed857
SHA256

c890bc2e899bdb9c2a7cbe9ab52b852c5ea6832e44615f2afc66ab47925866d2
SHA512

c4dcbb0b0fdc7469c6e5abc038867f3c65e179a3692dc884d7713db20c2fdefb4f96d5369210aedf807008cbe3821b05fb2a162c45a603aa0c68d56962d4e9a0

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	UD_PO_000681.exe
Token: SeRestorePrivilege	1936	WerFault.exe
Token: SeBackupPrivilege	1936	WerFault.exe
Token: SeDebugPrivilege	1936	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1500	UD_PO_000681.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe
1936	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1500	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\UD_PO_000681.exe
"C:\Users\Admin\AppData\Local\Temp\UD_PO_000681.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 936
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/1936-1-0x0000000005A70000-0x0000000005A71000-memory.dmp

Filesize
4KB

Download