8459e6fc893b7dd880895eb1be14cf8a3bec6003bbb8493f819e48ba84491b87 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 07:39

Sharing

Report Analysis Logs

General

Target

F2EzKUpFLjTmAQl.exe
Size

1.1MB
MD5

96a9c353590be3958e382b08ba97a56b
SHA1

f1e86a114513e89ee754cd1775432c12540e7481
SHA256

8459e6fc893b7dd880895eb1be14cf8a3bec6003bbb8493f819e48ba84491b87
SHA512

2cb8ef090ff0928e05875851f8491d416c25e795c49e10fbe1195a0801f8460d1738ab643a88225ecdb7486e7f6156ff80201251a52b2a57d7c142f50d4c850f

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	3588	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3800	WerFault.exe
Token: SeBackupPrivilege	3800	WerFault.exe
Token: SeDebugPrivilege	3800	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\F2EzKUpFLjTmAQl.exe
"C:\Users\Admin\AppData\Local\Temp\F2EzKUpFLjTmAQl.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1160
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-0-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/3800-1-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/3800-3-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3800-4-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download