b633c0e44bd60afbcf59a3802cf2703b1604eae7666c411e08ba2a6b31edcbda | Triage

Analysis

max time kernel
124s
max time network
125s
platform
windows10_x64
resource
win10
submitted
10/07/2020, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

customers_dhl_form.exe
Size

601KB
MD5

9e610f42413bbf1704d725c71def3c99
SHA1

36d6f7604fd112dbeabc0d07ec64d1957d2245af
SHA256

b633c0e44bd60afbcf59a3802cf2703b1604eae7666c411e08ba2a6b31edcbda
SHA512

4658a2716940ff455b4e02dbffefb598b9c8af6a90edcad383bad5527f43ad5afabc17b4a0544d1bc2fc4de9679656ac30c46d2f8ecd273c73c6accd15d82cd7

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3704	customers_dhl_form.exe
Token: SeRestorePrivilege	3896	WerFault.exe
Token: SeBackupPrivilege	3896	WerFault.exe
Token: SeDebugPrivilege	3896	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3704	customers_dhl_form.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3896	3704	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\customers_dhl_form.exe
"C:\Users\Admin\AppData\Local\Temp\customers_dhl_form.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 1268
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3896-0-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3896-1-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download