ad2da1fa0e285bd992c7dc1d0dcad3f5a476bd62478ebf958326302942fabeec | Triage

Analysis

max time kernel
149s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
09/07/2020, 07:12

Sharing

Report Analysis Logs

General

Target

Shipping Details 00459010265 - 07.07.2020.exe
Size

719KB
MD5

ec25c93cf619cf346cbb955af0518baf
SHA1

6a72eb049453cc1aa268f424eb03fa4b466bcfea
SHA256

ad2da1fa0e285bd992c7dc1d0dcad3f5a476bd62478ebf958326302942fabeec
SHA512

52886dbab173286145b16e61a45051ca8a79bf94ed317e7f35047552c2ce47f51610f46e22b19b8dafa748f0c7c6974bbbd22e059ce28578810837540bb96df8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	3812	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2080	WerFault.exe
Token: SeBackupPrivilege	2080	WerFault.exe
Token: SeDebugPrivilege	2080	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Details 00459010265 - 07.07.2020.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Details 00459010265 - 07.07.2020.exe"
1⤵
PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 1148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/2080-3-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download