70e4e361ebf8d3e573223e93605af3a0322b93e420b30812ee7c707317fe58ab | Triage™

Analysis

max time kernel
128s
max time network
90s
platform
windows10_x64
resource
win10v200430
submitted
10/07/2020, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHIPMENT.exe
Size 468KB
Sample200710-hr7ca8mz3n
SHA256 70e4e361ebf8d3e573223e93605af3a0322b93e420b30812ee7c707317fe58ab
MD5 5fa722b6d440389f347b1fb87da444a5
SHA1 f2479a21f0080c30798044e99240fd469c664e0a
SHA512 941a9926a230006588899e68cf16b299b9cc267c8a94428606fea54f7d532724f58718788514144777835fa9d244b5384463a00b55e3ad86b492f6ad56b2dc83
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	SHIPMENT.exe
Token: SeRestorePrivilege	2424	WerFault.exe
Token: SeBackupPrivilege	2424	WerFault.exe
Token: SeDebugPrivilege	2424	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3216	SHIPMENT.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	3216	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\SHIPMENT.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPMENT.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 1276
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-0-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/2424-1-0x0000000005200000-0x0000000005201000-memory.dmp

Download