81cda34b60dedcf70edb46f6bbb8e55a58395c217655109447803779111c3922 | Triage

Analysis

max time kernel
135s
max time network
99s
platform
windows10_x64
resource
win10v200430
submitted
13/07/2020, 14:44

Sharing

Report Analysis Logs

General

Target

SMK_0592841963.exe
Size

705KB
MD5

a7d974de7dcc6289120e96e1c3ed8811
SHA1

68a4c25464fcc23335cefc729176e43f710c8ac2
SHA256

81cda34b60dedcf70edb46f6bbb8e55a58395c217655109447803779111c3922
SHA512

60892933faa6f22fce11974717b0d62c597a63912d3fda55506a41aa98283e53c9129440e6d3cd6b9e8703a9f3e5fe591d543c0df4010239d7964995bf75634a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	3944	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe
2268	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2268	WerFault.exe
Token: SeBackupPrivilege	2268	WerFault.exe
Token: SeDebugPrivilege	2268	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SMK_0592841963.exe
"C:\Users\Admin\AppData\Local\Temp\SMK_0592841963.exe"
1⤵
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 912
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/2268-1-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/2268-3-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download