d90041e6b2a7deca5936829d8a2f6b9c190abcab6c81c3a99b22d41ed6fffbb0 | Triage

Analysis

max time kernel
135s
max time network
94s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 05:51

Sharing

Report Analysis Logs

General

Target

hesaphareketi000001,pdf.exe
Size

2.9MB
MD5

62365690663bb84166207a981d124d64
SHA1

35a0d45093ab7d5e6acc22b0f1b1ee0eaf38da26
SHA256

d90041e6b2a7deca5936829d8a2f6b9c190abcab6c81c3a99b22d41ed6fffbb0
SHA512

2b35cbbe45a125f373d4f57b1184e12ab88c4cd6c76d51bdc4f928a89bdf324eb4cd036fe9df22c69858bd83d9bfd07b012630ea7ebccbb877373f3c235b1135

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2784 2860 WerFault.exe hesaphareketi000001,pdf.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

hesaphareketi000001,pdf.exeWerFault.exe

pid	process
2860	hesaphareketi000001,pdf.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

hesaphareketi000001,pdf.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2860	hesaphareketi000001,pdf.exe
Token: SeRestorePrivilege	2784	WerFault.exe
Token: SeBackupPrivilege	2784	WerFault.exe
Token: SeDebugPrivilege	2784	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi000001,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi000001,pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1288
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/2784-1-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/2784-3-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download