6ce07f9854b3d9f983265569f34a640a9f274c1bfd30fcba4b6bb64c957ecc54 | Triage

Analysis

max time kernel
69s
max time network
118s
platform
windows10_x64
resource
win10
submitted
13/07/2020, 06:23

Sharing

Report Analysis Logs

General

Target

nova narud#U017eba.exe
Size

321KB
MD5

a35772d14e29eff85dcd2d5fc74ab08c
SHA1

b1b5f8f29619273be7e5ea1fc360bd5634f8fb13
SHA256

6ce07f9854b3d9f983265569f34a640a9f274c1bfd30fcba4b6bb64c957ecc54
SHA512

24a531f25744ce69269fec48b13337c3711f65d16b989369780cfe609a25cbce86c6a9d8df5b678c0688ad62a7d6ca2dc61c66865f2c44dce85a89da5d2db46e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3240	3100	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3240	WerFault.exe
Token: SeBackupPrivilege	3240	WerFault.exe
Token: SeDebugPrivilege	3240	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\nova narud#U017eba.exe
"C:\Users\Admin\AppData\Local\Temp\nova narud#U017eba.exe"
1⤵
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 1136
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3240-0-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3240-1-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3240-3-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download