305586aa88966e490ba86bb7cd7a2e1cbe9f195c84b70aaf5ef0c9e714961723 | Triage

Analysis

max time kernel
136s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
13/07/2020, 14:15

Sharing

Report Analysis Logs

General

Target

Solicitud de cotización.exe
Size

704KB
MD5

98054e4ae6c7641469ce21837edf0edd
SHA1

b6a40b5e98cdba9b61b0616b175d3061ade50b47
SHA256

305586aa88966e490ba86bb7cd7a2e1cbe9f195c84b70aaf5ef0c9e714961723
SHA512

fb02e4b049e30625d7895e292dae245ec8d652b8852f35e8fae95148b8504ae7905db54e47807bf2d7eb7ec9ab44e9a6d77e6efb36c198a06a1671e42547b215

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2804	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe
2748	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2748	WerFault.exe
Token: SeBackupPrivilege	2748	WerFault.exe
Token: SeDebugPrivilege	2748	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Solicitud de cotización.exe
"C:\Users\Admin\AppData\Local\Temp\Solicitud de cotización.exe"
1⤵
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 912
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/2748-1-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/2748-3-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download