a430a55dda341e88b1098cc062a7b768eebfe86161d2b7ec352cbe0d79a23b89 | Triage

Analysis

max time kernel
123s
max time network
126s
platform
windows10_x64
resource
win10
submitted
10-07-2020 17:03

Sharing

Report Analysis Logs

General

Target

TRANSFER REQUEST FORM (2).exe
Size

816KB
MD5

43edcf3a8731848513d701d3237844e9
SHA1

75d3d14db281b36b16522f478ec5bda72c2f824b
SHA256

a430a55dda341e88b1098cc062a7b768eebfe86161d2b7ec352cbe0d79a23b89
SHA512

3115a94951b2185cd9371fc17182d2771bff248a0c1aa27e211a6e8205dedcaaaab06553792ad6676797b60ff6ad521114c7158b8b6978546d6ee30fcf0a1118

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3828 732 WerFault.exe TRANSFER REQUEST FORM (2).exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3828 WerFault.exe
Token: SeBackupPrivilege 3828 WerFault.exe
Token: SeDebugPrivilege 3828 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\TRANSFER REQUEST FORM (2).exe
"C:\Users\Admin\AppData\Local\Temp\TRANSFER REQUEST FORM (2).exe"
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 916
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-0-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3828-1-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3828-3-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download