f9bd72771da7917018cfca8a80bb7dad2e8e029aedcd8851c320256243c5e9db | Triage

Analysis

max time kernel
148s
max time network
148s
platform
windows10_x64
resource
win10
submitted
09-07-2020 12:17

Sharing

Report Analysis Logs

General

Target

Detalles del banco.exe
Size

610KB
MD5

8ee663b59c093fa22f1253acc679ec41
SHA1

e151bc43031a0ebe8c3c90a77bfa7a4d47b71c7e
SHA256

f9bd72771da7917018cfca8a80bb7dad2e8e029aedcd8851c320256243c5e9db
SHA512

b5c0fdd43dcbff73b77d8690b6021a0f1c708299b43915b708f41d8338a4463da2043f936a76c60d04b5f9e13bc79f0338fc0b6a0e1e8ad12d4efb922ed48fab

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3948 3588 WerFault.exe Detalles del banco.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Detalles del banco.exeWerFault.exe

pid	process
3588	Detalles del banco.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Detalles del banco.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3588	Detalles del banco.exe
Token: SeRestorePrivilege	3948	WerFault.exe
Token: SeBackupPrivilege	3948	WerFault.exe
Token: SeDebugPrivilege	3948	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Detalles del banco.exe
"C:\Users\Admin\AppData\Local\Temp\Detalles del banco.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1296
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3948-0-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/3948-2-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download