44703eacf8321a8fd05283f755a781a7cb17a55961159ab28d570c2196a79eb7 | Triage

Analysis

max time kernel
135s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 09:09

Sharing

Report Analysis Logs

General

Target

Payment Invoice.exe
Size

336KB
MD5

22997b8feb197ffc197b427c00c28f14
SHA1

74e8887e1629767090f7ed4e3f8abd92e718819f
SHA256

44703eacf8321a8fd05283f755a781a7cb17a55961159ab28d570c2196a79eb7
SHA512

d80e15c042f71675ccf50b93201aac64722c5b6a844c9c19e79eb330eda5c4e4fa09052a33399da3a6889779a823b4f824f442ba28594e790c3d254d9ab16477

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2604 2804 WerFault.exe Payment Invoice.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2604 WerFault.exe
Token: SeBackupPrivilege 2604 WerFault.exe
Token: SeDebugPrivilege 2604 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1156
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-0-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/2604-1-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download