963187e0780a5447539322536555e2e3898d85dfb6762e6f63d2bc634d6fa6c7 | Triage

Analysis

max time kernel
134s
max time network
147s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 05:08

Sharing

Report Analysis Logs

General

Target

invoice copy.pdf.exe
Size

555KB
MD5

08da5cb8effb83a1bfc20d4211960ddb
SHA1

48e27634adf28e5f88484d4a9b51613f01263d16
SHA256

963187e0780a5447539322536555e2e3898d85dfb6762e6f63d2bc634d6fa6c7
SHA512

321264e2615098be16f79206997a29087a495d4c1e351b495fed9cf83672fc1f9e304f4aa0fe3f0b247f23627eea0380961201bf9cbf1f0ef6ae57570f148a28

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2540 2040 WerFault.exe invoice copy.pdf.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2540 WerFault.exe
Token: SeBackupPrivilege 2540 WerFault.exe
Token: SeDebugPrivilege 2540 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\invoice copy.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\invoice copy.pdf.exe"
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 916
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download