b36bb088a516fe573f9d70983747a1753eccb0236bacd5f00d7cfe0cea99618c | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows10_x64
resource
win10
submitted
09-07-2020 18:29

Sharing

Report Analysis Logs

General

Target

Profoma.exe
Size

557KB
MD5

2dda182af8da0a3176e878200c2ecf00
SHA1

b48551b7ca6bba518a043f75940375cd4f3f927c
SHA256

b36bb088a516fe573f9d70983747a1753eccb0236bacd5f00d7cfe0cea99618c
SHA512

f30082c98f6392c565e1f559b4b592ab35d8e0bff3adb84912618cf84ee42c93ebcd54348d8ad9b66d884d7506472eac8d919fd618b8f57d70577d6bc30a03cc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1576 3908 WerFault.exe Profoma.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe
1576	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1576 WerFault.exe
Token: SeBackupPrivilege 1576 WerFault.exe
Token: SeDebugPrivilege 1576 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Profoma.exe
"C:\Users\Admin\AppData\Local\Temp\Profoma.exe"
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 912
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1576-0-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/1576-1-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download