ebc28d320cd55a376a0a3562417c47098d9468210abe553ac836b0a679131b39 | Triage

Analysis

max time kernel
69s
max time network
118s
platform
windows10_x64
resource
win10
submitted
13-07-2020 06:57

Sharing

Report Analysis Logs

General

Target

Payment Details.exe
Size

293KB
MD5

4074ddccd5e6150bb05f6231ca415e0a
SHA1

499d5776e16c73d69fa3ccf4bcaba1e87b9ae4c1
SHA256

ebc28d320cd55a376a0a3562417c47098d9468210abe553ac836b0a679131b39
SHA512

cd9f50ad40dcbe5205572aa35d1a4b1c2b8e785dc61e3782cab52d75f9945e2bd382576f75ca595fc092112d8d14c1850fd839578ef8eb62dca4f563047deef2

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3240 WerFault.exe
Token: SeBackupPrivilege 3240 WerFault.exe
Token: SeDebugPrivilege 3240 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3240 3100 WerFault.exe Payment Details.exe

C:\Users\Admin\AppData\Local\Temp\Payment Details.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Details.exe"
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 1144
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3240-0-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/3240-1-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download