b01d0e871f96ddcf4df2358b7a452c488d628829d14d5ede0a58243cdd1dbdc7 | Triage™

Analysis

max time kernel
136s
max time network
96s
platform
windows10_x64
resource
win10v200430
submitted
15/07/2020, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Doc#162020094753525765344650094466.pdf.exe
Size 530KB
Sample200715-4qgz7rkhps
SHA256 b01d0e871f96ddcf4df2358b7a452c488d628829d14d5ede0a58243cdd1dbdc7
MD5 093a669a65b11c49ff04959d6eb4f2f1
SHA1 3f5b05b9cd510e24f88f3d2f24d7f5621fc442e6
SHA512 080a13ec5edaab5e98d27de2ef04de54360d7365f55ed7196f2cd654a0a5a46e863b499fd7c5a6622f8de70ccfa3208538225296237c16c7b42de97675f701cc
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	Doc#162020094753525765344650094466.pdf.exe
Token: SeRestorePrivilege	2576	WerFault.exe
Token: SeBackupPrivilege	2576	WerFault.exe
Token: SeDebugPrivilege	2576	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2580	Doc#162020094753525765344650094466.pdf.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2580	WerFault.exe	65

C:\Users\Admin\AppData\Local\Temp\Doc#162020094753525765344650094466.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Doc#162020094753525765344650094466.pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 1156
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-0-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/2576-1-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/2576-3-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download