c4031838bc163076ff2845546cad4c409d9cec8a2100d78d4ea1ea75579f7c37 | Triage

Analysis

max time kernel
122s
max time network
117s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEW requirement.exe
Size

735KB
MD5

d4b9f6bbb9325e1a23d299c0e1399935
SHA1

8c23967805c380f4aec14de92c533a4f95542341
SHA256

c4031838bc163076ff2845546cad4c409d9cec8a2100d78d4ea1ea75579f7c37
SHA512

b88b75c0211a2f8835dc519e579b7c0b2c7fe52bf1a108da005efb17917055dab53d379a8a2aa902e460a8fc10f381f0cac2d34d6ff2281d12c6218cf1398313

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	3828	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3424	WerFault.exe
Token: SeBackupPrivilege	3424	WerFault.exe
Token: SeDebugPrivilege	3424	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\NEW requirement.exe
"C:\Users\Admin\AppData\Local\Temp\NEW requirement.exe"
1⤵
PID:3828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1136
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3424-0-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/3424-1-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/3424-3-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download