9c1f76b540f055b2b6131cde2f6896e73f3e0170070c0551d90d20364156d32c | Triage

Analysis

max time kernel
147s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 05:59

Sharing

Report Analysis Logs

General

Target

Shipping Documents.exe
Size

652KB
MD5

9ad127f4f4d28ea19395cb16c194f23d
SHA1

21ce15a2f1ee49d7420ea368e51cf92b61028a4c
SHA256

9c1f76b540f055b2b6131cde2f6896e73f3e0170070c0551d90d20364156d32c
SHA512

b3e6f896c4d0747e0d575b1abc63eb96eb0cd791bce21275c44b58731494fa143f1ba03ea6185ee1d3c25366c32e8b26bdefdd4624f0f9780e3e8fcc64665d13

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	3768	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2184	WerFault.exe
Token: SeBackupPrivilege	2184	WerFault.exe
Token: SeDebugPrivilege	2184	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
1⤵
PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 900
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download
memory/2184-1-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download