726560b23196c87e1ed4bdd90c4d655ad0c2b935af6e436a20ba9277ffa99edf | Triage

Analysis

max time kernel
110s
max time network
112s
platform
windows10_x64
resource
win10
submitted
13-07-2020 06:52

Sharing

Report Analysis Logs

General

Target

Paymentslip.exe
Size

407KB
MD5

4c01b0109f1d384274d3d040a5986389
SHA1

1c9b48f4553cf8e253e1e2b837bb1a63538514e9
SHA256

726560b23196c87e1ed4bdd90c4d655ad0c2b935af6e436a20ba9277ffa99edf
SHA512

6d975336b2988d07aad33ce8f53a1b4436392c701e5fafbc52a1d98145cd84960fd967c79f180af8c5c2b50329aebcf56d118b1b7353fb62d2f539ba69c2c202

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3888 3892 WerFault.exe Paymentslip.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3888 WerFault.exe
Token: SeBackupPrivilege 3888 WerFault.exe
Token: SeDebugPrivilege 3888 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Paymentslip.exe
"C:\Users\Admin\AppData\Local\Temp\Paymentslip.exe"
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 1140
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3888-0-0x0000000004210000-0x0000000004211000-memory.dmp

Filesize
4KB

Download
memory/3888-1-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/3888-2-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download