34cf69d94adcbf7c3646400b9d457de10e974790ffa71278291b61426005f13e | Triage

Analysis

max time kernel
65s
max time network
69s
platform
windows10_x64
resource
win10
submitted
13-07-2020 06:24

Sharing

Report Analysis Logs

General

Target

DRAWINGS.exe
Size

369KB
MD5

ca8c87affb36ce80079f499ca8dd3182
SHA1

0fa6a924943f23db0a598903280ac8b8bea84943
SHA256

34cf69d94adcbf7c3646400b9d457de10e974790ffa71278291b61426005f13e
SHA512

ae77b5e4bbdbb0dfcad910e4eedc0280154b49d44c0ff6ca495e716bb5e5f4167dc4be6df3b6926ffd58148c42fd5eaee500b26fd745895dd190710c2f562108

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4080 3104 WerFault.exe DRAWINGS.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4080 WerFault.exe
Token: SeBackupPrivilege 4080 WerFault.exe
Token: SeDebugPrivilege 4080 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DRAWINGS.exe
"C:\Users\Admin\AppData\Local\Temp\DRAWINGS.exe"
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1148
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4080-0-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/4080-1-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/4080-3-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download