7e0b697ca060ceb919fa17715a88ffe9cf8ad66e3e95a720400f27777fbed132 | Triage

Analysis

max time kernel
67s
max time network
96s
platform
windows10_x64
resource
win10v200430
submitted
14-07-2020 13:47

Sharing

Report Analysis Logs

General

Target

Customers Requirment_pdf .scr.exe
Size

425KB
MD5

5bf14fa31940ec3bd25065d3d51fe36d
SHA1

d7f52b052c34b5a3a123b9812fc296fd25e75cfd
SHA256

7e0b697ca060ceb919fa17715a88ffe9cf8ad66e3e95a720400f27777fbed132
SHA512

91dccb46548cfe993efb7bfb263698a545d47385538416bf160457ea019f8880d8fddf072a8d4594749fba7c313f1a6419cdb5d78b37e724087a5dfdbcced56c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	2564	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2564	Customers Requirment_pdf .scr.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	Customers Requirment_pdf .scr.exe
Token: SeRestorePrivilege	1724	WerFault.exe
Token: SeBackupPrivilege	1724	WerFault.exe
Token: SeDebugPrivilege	1724	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Customers Requirment_pdf .scr.exe
"C:\Users\Admin\AppData\Local\Temp\Customers Requirment_pdf .scr.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 1168
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download