c60f9a3c78588d75a17c74eac45f113259702d485d5d58ab6a5154ad424193f6 | Triage

Analysis

max time kernel
125s
max time network
128s
platform
windows10_x64
resource
win10
submitted
13/07/2020, 06:55

Sharing

Report Analysis Logs

General

Target

Order WJ200702.exe
Size

565KB
MD5

220eb9868bc36d7369a16381934de66c
SHA1

1a60df1e7ebe11b072c6d71c86d1bb4e2e975293
SHA256

c60f9a3c78588d75a17c74eac45f113259702d485d5d58ab6a5154ad424193f6
SHA512

3068c2990e7ca596faab8572bc717c8c657fc7721ce9897130ebaaa791ac27a6706971872743c6cb6260bd7ae6cffaaeee001acbb62678376eb86c3856a8eccd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3852	3676	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3852	WerFault.exe
Token: SeBackupPrivilege	3852	WerFault.exe
Token: SeDebugPrivilege	3852	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order WJ200702.exe
"C:\Users\Admin\AppData\Local\Temp\Order WJ200702.exe"
1⤵
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1136
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-0-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download
memory/3852-1-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download