b3fae3604c2728ada2387f42fc4a5128da931601f39c6e7bee7dd6987ce1e0cf | Triage

Analysis

max time kernel
135s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 09:09

Sharing

Report Analysis Logs

General

Target

Quotation Request.exe
Size

549KB
MD5

a1ca5b40094d50698e1558eb62c93241
SHA1

0a96f3a653ad6b7412f0d7ffb8114b65af367993
SHA256

b3fae3604c2728ada2387f42fc4a5128da931601f39c6e7bee7dd6987ce1e0cf
SHA512

6834c4bf94320640c5651c7730769902dc8f11fc0b201090e45845a2c0051eea3b869604e334e77bccd5f7417aaf903a8f23ff4f9899f0ff02749eb1a6137b3b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 1516 WerFault.exe Quotation Request.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe
2160	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2160 WerFault.exe
Token: SeBackupPrivilege 2160 WerFault.exe
Token: SeDebugPrivilege 2160 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 940
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-0-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/2160-1-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/2160-2-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download