8d98cc9cafea7bf31e27287f1002cbade82ac19f44d2b12584598509b8b10c99 | Triage

Analysis

max time kernel
136s
max time network
98s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 12:11

Sharing

Report Analysis Logs

General

Target

hesaphareketi001,pdf.exe
Size

645KB
MD5

a24efe06eef9d062d226bf5eec6606d3
SHA1

beebac09e6663d88f36d39027a10b1512970f7f6
SHA256

8d98cc9cafea7bf31e27287f1002cbade82ac19f44d2b12584598509b8b10c99
SHA512

66059895c17a8edd0688977ab81ffa7056cbbda6cc8ad10fcfc51e0ea88a4f9c3d29d63864ebce52810bdf26101861f195842ce7ae14dce762586aac5c419dfa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2436 3944 WerFault.exe hesaphareketi001,pdf.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

hesaphareketi001,pdf.exeWerFault.exe

pid	process
3944	hesaphareketi001,pdf.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

hesaphareketi001,pdf.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3944	hesaphareketi001,pdf.exe
Token: SeRestorePrivilege	2436	WerFault.exe
Token: SeBackupPrivilege	2436	WerFault.exe
Token: SeDebugPrivilege	2436	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi001,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi001,pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1280
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download