e024da5585bb4c5b9e633675cf6a9bb596152bc4650ddeccfe6b9b4a763f5d3f | Triage

Analysis

max time kernel
75s
max time network
136s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:10

Sharing

Report Analysis Logs

General

Target

unl.exe
Size

418KB
MD5

15ba350c9a703c5e822add0d18ab0600
SHA1

1e1bf5d0dbb77a0f74d397949bce454f34fc9670
SHA256

e024da5585bb4c5b9e633675cf6a9bb596152bc4650ddeccfe6b9b4a763f5d3f
SHA512

beace9529e572b1b238107b8e57020ee81e0018788e467c326236697bb34022a29959e162479aea064861768986b691ad1417c25950678926b1377ea5b4cbd08

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1840 3060 WerFault.exe unl.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1840 WerFault.exe
Token: SeBackupPrivilege 1840 WerFault.exe
Token: SeDebugPrivilege 1840 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\unl.exe
"C:\Users\Admin\AppData\Local\Temp\unl.exe"
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 912
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-0-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/1840-1-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download