69ea320678acca63c52c05f9d51fb2ed84a6e454b0925bdf7d4a40d70f083bdc | Triage™

Analysis

max time kernel
62s
max time network
113s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
july9o.exe
Size 610KB
Sample200709-2ayryz91fx
SHA256 69ea320678acca63c52c05f9d51fb2ed84a6e454b0925bdf7d4a40d70f083bdc
MD5 2a22ab4eba2aefb03b467815ea4c6ac5
SHA1 58e305aeafba39f4b6b40195e968f47e43461b3d
SHA512 b495020e62a6a65ebfee310e5fef95c168d2bbd7e1e256fc48832b6d4415e33b12c2b56d9a4baf54f8d56703c9e5884e4b212c68fe0fc747f4d98f8ce15ade12
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	4036	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4036	july9o.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	july9o.exe
Token: SeRestorePrivilege	756	WerFault.exe
Token: SeBackupPrivilege	756	WerFault.exe
Token: SeDebugPrivilege	756	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\july9o.exe
"C:\Users\Admin\AppData\Local\Temp\july9o.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1264
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-0-0x0000000004940000-0x0000000004941000-memory.dmp

Download

memory/756-1-0x0000000005080000-0x0000000005081000-memory.dmp

Download