f4119900c427b8db4429de992f650b4a833a31df5aa565bc2614f2d4e49d5b76 | Triage

Analysis

max time kernel
135s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 17:57

Sharing

Report Analysis Logs

General

Target

RFQ.4414_122.exe
Size

599KB
MD5

5989baa4ab5e9dbd5b44a166385da339
SHA1

434714ba549164447f29efe51e2fe5129a96dd08
SHA256

f4119900c427b8db4429de992f650b4a833a31df5aa565bc2614f2d4e49d5b76
SHA512

4c9bfe7fe07524bf285e897b76ac7a76d67782d87832d1b89755e0bc590b827b43cea4b06aabb8ea59c4e85bdbdd54bd20869b3ec5dfdc839b5e843ab4cfd937

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 1632 WerFault.exe RFQ.4414_122.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2836 WerFault.exe
Token: SeBackupPrivilege 2836 WerFault.exe
Token: SeDebugPrivilege 2836 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ.4414_122.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ.4414_122.exe"
1⤵
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 896
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-0-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/2836-1-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/2836-3-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download