aff8e79eb627e87ebf95d5f77df5a0ca063004b733df90cd1caad8350eca88b3 | Triage

Analysis

max time kernel
131s
max time network
103s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 06:40

Sharing

Report Analysis Logs

General

Target

goodluck.exe
Size

153KB
MD5

47e106c6e4d029735df66593393da569
SHA1

841d185e4ec5bc8a97e9a32af570ab99276849aa
SHA256

aff8e79eb627e87ebf95d5f77df5a0ca063004b733df90cd1caad8350eca88b3
SHA512

5f0402bcb7df542b19916d97e866f5f1da916e36e7bb657a2e236fa019dbdb18b232956e4e8cc163a6f1086223f284084e2669e578a08d04d31f3df025adee86

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2528 1064 WerFault.exe goodluck.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2528 WerFault.exe
Token: SeBackupPrivilege 2528 WerFault.exe
Token: SeDebugPrivilege 2528 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\goodluck.exe
"C:\Users\Admin\AppData\Local\Temp\goodluck.exe"
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 1140
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-0-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download