0e7d9a0423e2abe849c313d741de58cb172512f0b81ca56680a0c98bcc5a28e8 | Triage

Analysis

max time kernel
129s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
11-07-2020 06:09

Sharing

Report Analysis Logs

General

Target

PMT.exe
Size

641KB
MD5

7bf2c1a3e369148e2e59280a91c23abd
SHA1

769b19e5208760910a25e59508f6b4258ce0f7ee
SHA256

0e7d9a0423e2abe849c313d741de58cb172512f0b81ca56680a0c98bcc5a28e8
SHA512

e616f4599ec00843a7a28557a7af5aea18ed0ce4eaf97596aa3a25b3380817d2c4c5a62817bfd29d16d7d19aab177bdbba71b00242eb2836100512b1082004dc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2824 1616 WerFault.exe PMT.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2824 WerFault.exe
Token: SeBackupPrivilege 2824 WerFault.exe
Token: SeDebugPrivilege 2824 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PMT.exe
"C:\Users\Admin\AppData\Local\Temp\PMT.exe"
1⤵
PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 900
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-0-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/2824-1-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/2824-2-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download