8e18f7d57532e145224c23b3bdbdfcc04cb394e0e3506bccef49eed06f3d2e10 | Triage™

Analysis

max time kernel
117s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
15/07/2020, 05:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tracking No_SINI0068206497.gz.exe
Size 761KB
Sample200715-cmjp6a5cle
SHA256 8e18f7d57532e145224c23b3bdbdfcc04cb394e0e3506bccef49eed06f3d2e10
MD5 7c6ffb6b608997b97ae535a8ebd8844b
SHA1 ba3a19687a96bb357fac59ca902299fbd12523e5
SHA512 c9da45ff9b589dac7c5da858ad8f72a5ff0a0b53c057941f2b4c776de360f42a89d4f7d62a7c5bc354afa929cdfbd674cc5b9c694a317e98b943ea58f4082215
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3780	1820	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1820	Tracking No_SINI0068206497.gz.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	Tracking No_SINI0068206497.gz.exe
Token: SeRestorePrivilege	3780	WerFault.exe
Token: SeBackupPrivilege	3780	WerFault.exe
Token: SeDebugPrivilege	3780	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.gz.exe
"C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.gz.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 1132
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3780-0-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download