bc69bdca3ab5100f73cc0f604137dd85411ae8e457a9fcee7cfecf356eb9371f | Triage

Analysis

max time kernel
75s
max time network
148s
platform
windows10_x64
resource
win10
submitted
10/07/2020, 16:38

Sharing

Report Analysis Logs

General

Target

Products Order.exe
Size

434KB
MD5

e8e24888a8f624e2c25fce52a77fcbed
SHA1

7d172fb3408e0b1553426f20754eeee60b1359a5
SHA256

bc69bdca3ab5100f73cc0f604137dd85411ae8e457a9fcee7cfecf356eb9371f
SHA512

0cbad95a957568c95d1b2cde7410666ad6f89e09fe41585f5768ab420f5d86b17bfaa099ff486f41c7b9644b0b890e71d6b0c4f453ba7b0a845cc846798300f6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3792	3588	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3792	WerFault.exe
Token: SeBackupPrivilege	3792	WerFault.exe
Token: SeDebugPrivilege	3792	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Products Order.exe
"C:\Users\Admin\AppData\Local\Temp\Products Order.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 912
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3792-0-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3792-2-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download