5f885377d87bbb8384fa51505cbb454bd758c621febcfb5e5aff42e1379c1430 | Triage

Analysis

max time kernel
132s
max time network
104s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 12:15

Sharing

Report Analysis Logs

General

Target

New Order.exe
Size

461KB
MD5

f43dbc77e78eec495daef1fa8c28021d
SHA1

0ec7cffae73e2d248a74d2ebf399222ceb9d5a31
SHA256

5f885377d87bbb8384fa51505cbb454bd758c621febcfb5e5aff42e1379c1430
SHA512

ed4e90b9991a0dec069ec1ad6ed459d45c6ca46948ed2b6ed4abb762a96aab3cac6278c484a7dec4863408f4dc27df8540e03143d9299ea50c118a83cbfe4e26

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2888 1260 WerFault.exe New Order.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2888 WerFault.exe
Token: SeBackupPrivilege 2888 WerFault.exe
Token: SeDebugPrivilege 2888 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe
2888	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 1144
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-0-0x0000000004470000-0x0000000004471000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download