160e88f42b6a24d4a995142e7e6288f44bf85fbf1afcc0dd9ff4931bd9bc82f2 | Triage

Analysis

max time kernel
66s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 16:58

Sharing

Report Analysis Logs

General

Target

wnrCLqWI1j9.exe
Size

648KB
MD5

62c080a8e9a46c40827ccf560a7ff489
SHA1

7e0ca441df2adbd4fcd8250033de92688e1f414a
SHA256

160e88f42b6a24d4a995142e7e6288f44bf85fbf1afcc0dd9ff4931bd9bc82f2
SHA512

cd1553ec064db5dbe3e6621cb846e369ee9f873b348205cd5ea418d3350935c79b2a471b6897b4f7511ffa373f5de454a2fdf4ef68b1a42c17265f2d2439633d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2784 2536 WerFault.exe wnrCLqWI1j9.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe
2784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2784 WerFault.exe
Token: SeBackupPrivilege 2784 WerFault.exe
Token: SeDebugPrivilege 2784 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\wnrCLqWI1j9.exe
"C:\Users\Admin\AppData\Local\Temp\wnrCLqWI1j9.exe"
1⤵
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 900
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/2784-1-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/2784-2-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download