f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397 | Triage

Analysis

max time kernel
134s
max time network
32s
platform
windows7_x64
resource
win7v200430
submitted
09/07/2020, 13:48

Sharing

Report Analysis Logs

General

Target

f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe
Size

5KB
MD5

525b3925ccf50db66710afdc2fb0c9e5
SHA1

eb76311855d5e4662a4e9caf76be7b4601be57a9
SHA256

f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397
SHA512

74a1d82f11a542535c9de3505e92c1905888578da0d9fb45aeaa4ca1572d0afa06e35fbcf2e51c76266bef9cb389cc923f1d71f50146e7f970b57e24fdc30541

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe
1252	WerFault.exe

Modifies control panel 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\SCRNSAVE.EXE	f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\SCRNSAVE.EXE\DiagSvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe\""	f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe
Token: SeDebugPrivilege	1252	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	1492	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1252	1492	f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe	27
PID 1492 wrote to memory of 1252	1492	f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe	27
PID 1492 wrote to memory of 1252	1492	f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe	27

C:\Users\Admin\AppData\Local\Temp\f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe
"C:\Users\Admin\AppData\Local\Temp\f70c4044cff54d7bb32634d189f5ac234091f53a5acce9f17dcfefca4c22b397.exe"
1⤵
- Modifies control panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1492 -s 612
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Program crash
  PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-1-0x0000000001F60000-0x0000000001F71000-memory.dmp

Filesize
68KB

Download
memory/1252-2-0x0000000002AF0000-0x0000000002B01000-memory.dmp

Filesize
68KB

Download