58d768f07fcda67d37434fedc49fd4fcbceae9913a6d23d42c9449b3865f9e43 | Triage™

Analysis

max time kernel
147s
max time network
93s
platform
windows10_x64
resource
win10v200430
submitted
12/07/2020, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PETJT2 REPORT_jpg .exe
Size 829KB
Sample200712-rvmctsqfbe
SHA256 58d768f07fcda67d37434fedc49fd4fcbceae9913a6d23d42c9449b3865f9e43
MD5 071fda1d63bda3250d443132084998b4
SHA1 add5acf8caebb64f45b7ccd68635097f8012e924
SHA512 17a47eeeadc0e6247483e320b0ed5705c2074ab15e58e80b499ab4cbdca86a7f927a612dd5f6db97e076a35bd65697547829f79986ce87f5c7952ddc207a1fe0
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	3768	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3768	PETJT2 REPORT_jpg .exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe
1924	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	PETJT2 REPORT_jpg .exe
Token: SeRestorePrivilege	1924	WerFault.exe
Token: SeBackupPrivilege	1924	WerFault.exe
Token: SeDebugPrivilege	1924	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PETJT2 REPORT_jpg .exe
"C:\Users\Admin\AppData\Local\Temp\PETJT2 REPORT_jpg .exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 1092
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/1924-1-0x00000000051F0000-0x00000000051F1000-memory.dmp

Download