c60f9a3c78588d75a17c74eac45f113259702d485d5d58ab6a5154ad424193f6 | Triage

Analysis

max time kernel
125s
max time network
128s
platform
windows10_x64
resource
win10
submitted
13-07-2020 06:55

Sharing

Report Analysis Logs

General

Target

Order WJ200702.exe
Size

565KB
MD5

220eb9868bc36d7369a16381934de66c
SHA1

1a60df1e7ebe11b072c6d71c86d1bb4e2e975293
SHA256

c60f9a3c78588d75a17c74eac45f113259702d485d5d58ab6a5154ad424193f6
SHA512

3068c2990e7ca596faab8572bc717c8c657fc7721ce9897130ebaaa791ac27a6706971872743c6cb6260bd7ae6cffaaeee001acbb62678376eb86c3856a8eccd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3852 3676 WerFault.exe Order WJ200702.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3852 WerFault.exe
Token: SeBackupPrivilege 3852 WerFault.exe
Token: SeDebugPrivilege 3852 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order WJ200702.exe
"C:\Users\Admin\AppData\Local\Temp\Order WJ200702.exe"
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-0-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download
memory/3852-1-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download