1198673d25413896f6cf12d91e54ef809a89925e1ddb495e7f97fdadf0506827 | Triage

Analysis

max time kernel
127s
max time network
128s
platform
windows10_x64
resource
win10
submitted
13-07-2020 07:04

Sharing

Report Analysis Logs

General

Target

DHL AIR WAY-BILL_6979374150_PDF.exe
Size

683KB
MD5

24241d7cf4d832eee8713e163f24a6b2
SHA1

c20c2294a9e74a64cce41ba1eb34f2aabb7581f0
SHA256

1198673d25413896f6cf12d91e54ef809a89925e1ddb495e7f97fdadf0506827
SHA512

7d29db7648b049ce0df39b77f82f37d8b5b5697e92d0ae8d4a1c1402da45b493bcadaadd31b4acc45ad5e6cb116e7f082ba427b730fe5902180efd37917a8bf8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3856 3748 WerFault.exe DHL AIR WAY-BILL_6979374150_PDF.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3856 WerFault.exe
Token: SeBackupPrivilege 3856 WerFault.exe
Token: SeDebugPrivilege 3856 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL AIR WAY-BILL_6979374150_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL AIR WAY-BILL_6979374150_PDF.exe"
1⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1140
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x0000000004380000-0x0000000004381000-memory.dmp

Filesize
4KB

Download
memory/3856-1-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download