684eb557696d45ec516edbae21d19c390e4261aefab4dd87c1b01d2f12a36715 | Triage

Analysis

max time kernel
70s
max time network
96s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:03

Sharing

Report Analysis Logs

General

Target

Order.exe
Size

604KB
MD5

856bb59a00ebbb5fe4a3e73484631f17
SHA1

381ae99021cd1c7f84035b1d821f4bbca81487fd
SHA256

684eb557696d45ec516edbae21d19c390e4261aefab4dd87c1b01d2f12a36715
SHA512

6ea13fb9084009bb4e2aee4f58d3525d89053b0ba92e9744e67af8fa4cdde70207f56abc77a760c2287bab5dde5e575bacf177807f254bf473f8ecdad4096208

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3856	3676	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3856	WerFault.exe
Token: SeBackupPrivilege	3856	WerFault.exe
Token: SeDebugPrivilege	3856	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order.exe
"C:\Users\Admin\AppData\Local\Temp\Order.exe"
1⤵
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 912
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/3856-1-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download