e1241bc4febe8d5eeb08b49056d73fed437a4e58b84c2e71933fa30625349012 | Triage

Analysis

max time kernel
123s
max time network
123s
platform
windows10_x64
resource
win10
submitted
09-07-2020 13:32

Sharing

Report Analysis Logs

General

Target

FedexAWBClearanceInformation_PDF.exe
Size

792KB
MD5

b0829b322fa68301b4d1ddcfa11a60a3
SHA1

5fb2b75037ca30d1c22229d0b3a15544ac124e8d
SHA256

e1241bc4febe8d5eeb08b49056d73fed437a4e58b84c2e71933fa30625349012
SHA512

c438d77cf26a6ccb87f28804707ebe728b4f95e50e0bae7c5e79c020d1cb349acec028f3b80bef6f0d476cff2178410d149a9a8909cf968db9f3b7aeb2ccc0c1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4016 3588 WerFault.exe FedexAWBClearanceInformation_PDF.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

FedexAWBClearanceInformation_PDF.exeWerFault.exe

pid	process
3588	FedexAWBClearanceInformation_PDF.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe
4016	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

FedexAWBClearanceInformation_PDF.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3588	FedexAWBClearanceInformation_PDF.exe
Token: SeRestorePrivilege	4016	WerFault.exe
Token: SeBackupPrivilege	4016	WerFault.exe
Token: SeDebugPrivilege	4016	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FedexAWBClearanceInformation_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\FedexAWBClearanceInformation_PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 940
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4016-0-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/4016-2-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download