9a461345aa76acd802aebd2426775b952f411c0c1def2ae141f23fe4a16b5e7c | Triage™

Analysis

max time kernel
135s
max time network
69s
platform
windows10_x64
resource
win10v200430
submitted
08/07/2020, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SCAN_PO CTL209-026.exe
Size 839KB
Sample200708-tcv365haea
SHA256 9a461345aa76acd802aebd2426775b952f411c0c1def2ae141f23fe4a16b5e7c
MD5 0957144bc6ea160515c1bfd6c2faa6d5
SHA1 e06dfa469646bc8cc28207abe7c8cb8116ab77e6
SHA512 15d4bcfe795bc5eadd2909427acfce5e713b2a0d4402aa0d88d49f8880298a2c12407ce8c5a1f23b84c6405ca14f2dbc30ae7c464d983563c1c5e9959e5a6010
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	2804	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2804	SCAN_PO CTL209-026.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	SCAN_PO CTL209-026.exe
Token: SeRestorePrivilege	1784	WerFault.exe
Token: SeBackupPrivilege	1784	WerFault.exe
Token: SeDebugPrivilege	1784	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SCAN_PO CTL209-026.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN_PO CTL209-026.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 936
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-0-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/1784-1-0x0000000005320000-0x0000000005321000-memory.dmp

Download