2044b097243f5bbb3ef44651d4845d064b3d89e491a1d68d78aa99fea74ae50f | Triage

Analysis

max time kernel
63s
max time network
110s
platform
windows10_x64
resource
win10
submitted
08-07-2020 10:09

Sharing

Report Analysis Logs

General

Target

Urgent orders _PDF____________________________________________.exe
Size

634KB
MD5

0a9a4fb69a373964f94e17b42cade496
SHA1

d82372b122c84c41b28ed8988d2a2d7cc7e9b0e2
SHA256

2044b097243f5bbb3ef44651d4845d064b3d89e491a1d68d78aa99fea74ae50f
SHA512

cc6cb4e12f9769098b3ce52e0726fca1faa5eecaffed62e84ae8e24d4b9bd15d0cf4a9a3f87bdf33d7322e60e09eb12d3c0e62e582c4f0b05643b256fa975833

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3796 976 WerFault.exe Urgent orders _PDF____________________________________________.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3796 WerFault.exe
Token: SeBackupPrivilege 3796 WerFault.exe
Token: SeDebugPrivilege 3796 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Urgent orders _PDF____________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent orders _PDF____________________________________________.exe"
1⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1152
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3796-0-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/3796-1-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/3796-2-0x0000000005A30000-0x0000000005A31000-memory.dmp

Filesize
4KB

Download