53a076f12f6d31f5d0ddbb7a9c061dfd29516342b0102504f60341e363636eb8 | Triage

Analysis

max time kernel
65s
max time network
110s
platform
windows10_x64
resource
win10
submitted
09-07-2020 13:45

Sharing

Report Analysis Logs

General

Target

New Purchase Order # DS2192472-14 & 135913.exe
Size

403KB
MD5

b5b940f3a5c44f7c568f55e711bd4e22
SHA1

4b81fd2ae56891dd623dd18bdb1bac1627f720da
SHA256

53a076f12f6d31f5d0ddbb7a9c061dfd29516342b0102504f60341e363636eb8
SHA512

ee4c712e7448c73e78880a20637feb4f39365e5b57faae981802ed5a878811e973becc6626a6ae18784d646a8049fff17498f29c0a5d971e6b524e3f2fec1e72

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3268 WerFault.exe
Token: SeBackupPrivilege 3268 WerFault.exe
Token: SeDebugPrivilege 3268 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3268 3588 WerFault.exe New Purchase Order # DS2192472-14 & 135913.exe

C:\Users\Admin\AppData\Local\Temp\New Purchase Order # DS2192472-14 & 135913.exe
"C:\Users\Admin\AppData\Local\Temp\New Purchase Order # DS2192472-14 & 135913.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1136
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-0-0x0000000004640000-0x0000000004641000-memory.dmp

Filesize
4KB

Download
memory/3268-1-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download