82a761b4157d1fa4e99dbf36c0f30935b19a1dd9875e330d81a70877aa07bc8a | Triage

Analysis

max time kernel
139s
max time network
139s
platform
windows10_x64
resource
win10
submitted
10-07-2020 13:34

Sharing

Report Analysis Logs

General

Target

FedExs AWB#5305323204643.exe
Size

327KB
MD5

4d535bf4723300864190a972b1d4f9ad
SHA1

eeb49ecc3842af963b1ab9eb017c5d672ea7fb37
SHA256

82a761b4157d1fa4e99dbf36c0f30935b19a1dd9875e330d81a70877aa07bc8a
SHA512

7991bcb4756e291d3618db2e1010a763bf3227e4015d160d9fd122d1ad401d67dc8cd1884dbf4f2853a29ceab1dd277e9c1b1526b941554586af608ba53c5f0b

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3792 WerFault.exe
Token: SeBackupPrivilege 3792 WerFault.exe
Token: SeDebugPrivilege 3792 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3792 3588 WerFault.exe FedExs AWB#5305323204643.exe

C:\Users\Admin\AppData\Local\Temp\FedExs AWB#5305323204643.exe
"C:\Users\Admin\AppData\Local\Temp\FedExs AWB#5305323204643.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 912
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3792-0-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/3792-1-0x00000000046C0000-0x00000000046C1000-memory.dmp

Filesize
4KB

Download
memory/3792-2-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download