bb44a88339e83bc2ecbd06edef1acf6c54e66c4c4922005a67c27f970f717075 | Triage

Analysis

max time kernel
68s
max time network
120s
platform
windows10_x64
resource
win10
submitted
09-07-2020 06:42

Sharing

Report Analysis Logs

General

Target

CMA-Inquiry DA39-RFQ-Urgent order-07820.exe
Size

952KB
MD5

7e8eedd86f24f4e63ed26ff677162e75
SHA1

e9a7b4c02a2f2916a3604a417af65260e33436a4
SHA256

bb44a88339e83bc2ecbd06edef1acf6c54e66c4c4922005a67c27f970f717075
SHA512

f16624dd72c63bb944d45c25c80a6ed6d8400e994e852db3879602b3107dd3e09dd7d1c5c893598f0d64f15bd98828bc7e67a48ee91943e833e13324d0d016c3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3892 3684 WerFault.exe CMA-Inquiry DA39-RFQ-Urgent order-07820.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

CMA-Inquiry DA39-RFQ-Urgent order-07820.exeWerFault.exe

pid	process
3684	CMA-Inquiry DA39-RFQ-Urgent order-07820.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe
3892	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

CMA-Inquiry DA39-RFQ-Urgent order-07820.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3684	CMA-Inquiry DA39-RFQ-Urgent order-07820.exe
Token: SeRestorePrivilege	3892	WerFault.exe
Token: SeBackupPrivilege	3892	WerFault.exe
Token: SeDebugPrivilege	3892	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\CMA-Inquiry DA39-RFQ-Urgent order-07820.exe
"C:\Users\Admin\AppData\Local\Temp\CMA-Inquiry DA39-RFQ-Urgent order-07820.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-0-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/3892-1-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/3892-2-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download