9dab0a321c760d7a1035404d1c401019e3680bbafb7fe7e25d90929be12e2d18 | Triage

Analysis

max time kernel
135s
max time network
136s
platform
windows10_x64
resource
win10
submitted
09-07-2020 08:40

Sharing

Report Analysis Logs

General

Target

Consignment Details_pdf.exe
Size

618KB
MD5

4b1f2cee6ef81b59d3325f5ae5959624
SHA1

499f626ed1951ca90f02274ae20f0e7646b3dcd5
SHA256

9dab0a321c760d7a1035404d1c401019e3680bbafb7fe7e25d90929be12e2d18
SHA512

0d72fe323eaf8e21c2cc77af18971e87dd2e02cb56c7765fd2a84f52e4d1c5d910880258714f72f0a699c21140faeb0ee3387ee78dd606bb66efdb00f28f335a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3600 3060 WerFault.exe Consignment Details_pdf.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Consignment Details_pdf.exeWerFault.exe

pid	process
3060	Consignment Details_pdf.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe
3600	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Consignment Details_pdf.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3060	Consignment Details_pdf.exe
Token: SeRestorePrivilege	3600	WerFault.exe
Token: SeBackupPrivilege	3600	WerFault.exe
Token: SeDebugPrivilege	3600	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Consignment Details_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Details_pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1132
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3600-0-0x00000000046F0000-0x00000000046F1000-memory.dmp

Filesize
4KB

Download
memory/3600-1-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download