f9bd72771da7917018cfca8a80bb7dad2e8e029aedcd8851c320256243c5e9db | Triage™

Analysis

max time kernel
148s
max time network
148s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Detalles del banco.exe
Size 610KB
Sample200709-hl3v5npcla
SHA256 f9bd72771da7917018cfca8a80bb7dad2e8e029aedcd8851c320256243c5e9db
MD5 8ee663b59c093fa22f1253acc679ec41
SHA1 e151bc43031a0ebe8c3c90a77bfa7a4d47b71c7e
SHA512 b5c0fdd43dcbff73b77d8690b6021a0f1c708299b43915b708f41d8338a4463da2043f936a76c60d04b5f9e13bc79f0338fc0b6a0e1e8ad12d4efb922ed48fab
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	3588	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3588	Detalles del banco.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe
3948	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	Detalles del banco.exe
Token: SeRestorePrivilege	3948	WerFault.exe
Token: SeBackupPrivilege	3948	WerFault.exe
Token: SeDebugPrivilege	3948	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Detalles del banco.exe
"C:\Users\Admin\AppData\Local\Temp\Detalles del banco.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1296
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3948-0-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/3948-2-0x0000000005520000-0x0000000005521000-memory.dmp

Download