72c10b54192d405bc77c0c1d6bd298c7d3c4c7fe40914c7c8b5c579805e881b1 | Triage

Analysis

max time kernel
127s
max time network
131s
platform
windows10_x64
resource
win10
submitted
12/07/2020, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

QRN 0127 Purchase Request Order No 07122020.exe
Size

387KB
MD5

f82d7d12715f5e6d548fc06afa2b3c57
SHA1

1218cb1e65dd72f26026e1ab300409a53fef52a5
SHA256

72c10b54192d405bc77c0c1d6bd298c7d3c4c7fe40914c7c8b5c579805e881b1
SHA512

2b648283c8df88ce2bd0cc72cd2a6817199216e98ca7560f6b5df226fad3095502a2589d7bc4a8060dc314a678de561d755636bd3660d99700dc0b8ab4a0633e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3872	4092	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3872	WerFault.exe
Token: SeBackupPrivilege	3872	WerFault.exe
Token: SeDebugPrivilege	3872	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\QRN 0127 Purchase Request Order No 07122020.exe
"C:\Users\Admin\AppData\Local\Temp\QRN 0127 Purchase Request Order No 07122020.exe"
1⤵
PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 1140
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3872-0-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/3872-1-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/3872-2-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download