Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    09-07-2020 08:40

General

  • Target

    Consignment Details_pdf.exe

  • Size

    618KB

  • MD5

    4b1f2cee6ef81b59d3325f5ae5959624

  • SHA1

    499f626ed1951ca90f02274ae20f0e7646b3dcd5

  • SHA256

    9dab0a321c760d7a1035404d1c401019e3680bbafb7fe7e25d90929be12e2d18

  • SHA512

    0d72fe323eaf8e21c2cc77af18971e87dd2e02cb56c7765fd2a84f52e4d1c5d910880258714f72f0a699c21140faeb0ee3387ee78dd606bb66efdb00f28f335a

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Consignment Details_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Consignment Details_pdf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3060
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1132
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3600-0-0x00000000046F0000-0x00000000046F1000-memory.dmp

    Filesize

    4KB

  • memory/3600-1-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

    Filesize

    4KB