a749be2de66fdb6e7705ce0bffe10f4d134345d2af814f258fdd2b863b12694b | Triage

Analysis

max time kernel
62s
max time network
110s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:01

Sharing

Report Analysis Logs

General

Target

TT Copy.exe
Size

231KB
MD5

220ad313de9cde3b09da63a4f8ce5646
SHA1

6b26fa40b5b40569f6db27a01e8872f9b9b0f937
SHA256

a749be2de66fdb6e7705ce0bffe10f4d134345d2af814f258fdd2b863b12694b
SHA512

57d39f77e90cc378ceccb3feb779b9bf50d8870d0291bec76e66f61aec847dda7d64e1636c4af27f93454cc59996a8a616188c4a7aa1d6b8581070e1107d63ed

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3268 1908 WerFault.exe TT Copy.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3268 WerFault.exe
Token: SeBackupPrivilege 3268 WerFault.exe
Token: SeDebugPrivilege 3268 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\TT Copy.exe
"C:\Users\Admin\AppData\Local\Temp\TT Copy.exe"
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 912
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-0-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/3268-1-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/3268-3-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download