e734cfb1c78da531edac0e5772b8892c4995862bffb6e8f5eb4bbc7a2090c174 | Triage

Analysis

max time kernel
136s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 17:02

Sharing

Report Analysis Logs

General

Target

Shipping Documents.exe
Size

590KB
MD5

e87f847dd6aea20684b67ab3eab8e992
SHA1

24531e53a0cffd0d4772bebebad7eb5a5071dfec
SHA256

e734cfb1c78da531edac0e5772b8892c4995862bffb6e8f5eb4bbc7a2090c174
SHA512

c222f478e1028cf7591f9f612dcb449e8b1e5278a608c665388a4338105afabab4d253f5738c4db678ed1a1770258083dd15560a135b2560e3860e242c05c057

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2744	WerFault.exe
Token: SeBackupPrivilege	2744	WerFault.exe
Token: SeDebugPrivilege	2744	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe
2744	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	2804	WerFault.exe	65

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
1⤵
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 920
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-0-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/2744-1-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download