c13a9fe750e9c765f6e9b8d5ac7de574ee533743261bd070c32054cd197bdf41 | Triage

Analysis

max time kernel
146s
max time network
142s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 08:38

Sharing

Report Analysis Logs

General

Target

RFQ_Section_III_Returnable Bidding Forms - IUS-UWS-SAN -0112.exe
Size

515KB
MD5

b338d235f56a4e4d560dc5984531d02e
SHA1

a12ce76f69be3397ac2636e3e2b06fd82715bf2e
SHA256

c13a9fe750e9c765f6e9b8d5ac7de574ee533743261bd070c32054cd197bdf41
SHA512

1673aba3e1921f93f9066803143ad32257b5942209040c95ef8b0705a9e2aec7f64f3bd47d5f933f014b128ee51c0b63a2a30c9ec6e5a3e8583913ba89fdd98d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2156 3544 WerFault.exe RFQ_Section_III_Returnable Bidding Forms - IUS-UWS-SAN -0112.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe
2156	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2156 WerFault.exe
Token: SeBackupPrivilege 2156 WerFault.exe
Token: SeDebugPrivilege 2156 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ_Section_III_Returnable Bidding Forms - IUS-UWS-SAN -0112.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_Section_III_Returnable Bidding Forms - IUS-UWS-SAN -0112.exe"
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x00000000044A0000-0x00000000044A1000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download