ec5ddee4daf077b22c49a35f10c16a4c2f191e3a125ce1b3f26b01fe7ad619cf | Triage™

Analysis

max time kernel
131s
max time network
126s
platform
windows10_x64
resource
win10
submitted
10/07/2020, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Consignment Details_pdf.exe
Size 632KB
Sample200710-38x9wgr85x
SHA256 ec5ddee4daf077b22c49a35f10c16a4c2f191e3a125ce1b3f26b01fe7ad619cf
MD5 73daf3aeb8744eb8ff3f16b41466e02c
SHA1 cc1e13d19617f0d1bf2838ed930fe1a4d5fc19b9
SHA512 11542663e06f791ebb93db0f03d543c03a17a2811a2b097ed977b21aaac100ea801b4535656cad03795d034137291a6d37539466f3d281a123516522fa2cbcee
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2920	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2920	Consignment Details_pdf.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	Consignment Details_pdf.exe
Token: SeRestorePrivilege	1960	WerFault.exe
Token: SeBackupPrivilege	1960	WerFault.exe
Token: SeDebugPrivilege	1960	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Consignment Details_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Consignment Details_pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1268
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-0-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/1960-1-0x0000000005A30000-0x0000000005A31000-memory.dmp

Download