3228552bf12eac0d0d241b72489b37b6f25e4f3fca6e7867a3dbc2b912f404fe | Triage

Analysis

max time kernel
120s
max time network
119s
platform
windows10_x64
resource
win10
submitted
09-07-2020 06:30

Sharing

Report Analysis Logs

General

Target

Order Specifications.exe
Size

711KB
MD5

5350d9dedce9039a41a8d5c1e9cb8f20
SHA1

47e845b83e0c561e42b73e0a8a54d0e3c9ad25b5
SHA256

3228552bf12eac0d0d241b72489b37b6f25e4f3fca6e7867a3dbc2b912f404fe
SHA512

46cefb5c1c7e0f8611afd21fea910430e299d4eb3761c507ca24ac35c6466f3cb9ea2f2c6d3dd6c49d8cb2bea248bbdbe9195a6171a5c7fb0308af8d498fad5c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3688 3908 WerFault.exe Order Specifications.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe
3688	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3688 WerFault.exe
Token: SeBackupPrivilege 3688 WerFault.exe
Token: SeDebugPrivilege 3688 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order Specifications.exe
"C:\Users\Admin\AppData\Local\Temp\Order Specifications.exe"
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 1148
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3688-0-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/3688-1-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/3688-3-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download