9886dbd251a349a2675e4b0bd53a0b24bed7858541d955f0c7449c6a5e15e4ee | Triage

Analysis

max time kernel
135s
max time network
134s
platform
windows10_x64
resource
win10
submitted
09-07-2020 12:13

Sharing

Report Analysis Logs

General

Target

PDF.New order.exe
Size

571KB
MD5

b4a67408bac84f6f0280dd23ca072ed0
SHA1

488ef4e8228dcec6621589751fafef6b2a7945e1
SHA256

9886dbd251a349a2675e4b0bd53a0b24bed7858541d955f0c7449c6a5e15e4ee
SHA512

c8239327dd70bb96fd6d5b15609468c8d254d684163e22eb1bb0f9eb2f68e9abe91578b30ea330f23b2bf552ac768f80d8a525fa960910d25260a24a95dce8ba

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1752 3904 WerFault.exe PDF.New order.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe
1752	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1752 WerFault.exe
Token: SeBackupPrivilege 1752 WerFault.exe
Token: SeDebugPrivilege 1752 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PDF.New order.exe
"C:\Users\Admin\AppData\Local\Temp\PDF.New order.exe"
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-0-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/1752-1-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download