2ebb200220490a9936a413ac6e0d47c0af044dbecffa1a36e9e124aec744a5f0 | Triage

Analysis

max time kernel
116s
max time network
115s
platform
windows10_x64
resource
win10
submitted
12-07-2020 08:11

Sharing

Report Analysis Logs

General

Target

Purchase Requirments Order NO 45000218350.exe
Size

394KB
MD5

d7df8bb6076ac28fbaf6939e1e53fad9
SHA1

cf380b776d529fae33506d1a06a1468fd1fe1f8d
SHA256

2ebb200220490a9936a413ac6e0d47c0af044dbecffa1a36e9e124aec744a5f0
SHA512

f24abcc0cf1f26fc268605fbf32874be6cb5c4eaf5c3c422c4a112b8131702d444bd0f2e93f43aa7734238bdc9c134ef74902b64e00b7b1daf3125fbae5cb99a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3796 3588 WerFault.exe Purchase Requirments Order NO 45000218350.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3796 WerFault.exe
Token: SeBackupPrivilege 3796 WerFault.exe
Token: SeDebugPrivilege 3796 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Requirments Order NO 45000218350.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Requirments Order NO 45000218350.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1140
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3796-0-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/3796-1-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download