d68fd5dc4b913479f183b0577cb42d4e9c7a38458d5301336e3a0ac4639ea29e | Triage

Analysis

max time kernel
143s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 07:03

Sharing

Report Analysis Logs

General

Target

docx_New Order.docx.exe
Size

346KB
MD5

d19bb675f1556e2617e336c79369d991
SHA1

87384fd048f16cc766e1a8944cfaaf37883f4989
SHA256

d68fd5dc4b913479f183b0577cb42d4e9c7a38458d5301336e3a0ac4639ea29e
SHA512

ff9091488693a8925df96cfa4049e269f69443e4214520faf1da6f00deecf25771b12547626abb94d678322db6a4ab9a702e8b267d5c0277354952649cb356e4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2692 3824 WerFault.exe docx_New Order.docx.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2692 WerFault.exe
Token: SeBackupPrivilege 2692 WerFault.exe
Token: SeDebugPrivilege 2692 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\docx_New Order.docx.exe
"C:\Users\Admin\AppData\Local\Temp\docx_New Order.docx.exe"
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-0-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/2692-1-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download