0e0b159fb42b06515c55e17eeba811fa4c46d87db89e821070b840303e063729 | Triage

Analysis

max time kernel
129s
max time network
107s
platform
windows10_x64
resource
win10v200430
submitted
15/07/2020, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

BTL GLOBAL LONG OVERDUE PAYMENT.exe
Size

1.3MB
MD5

fda41b6c829f05a7ffbee54fa50e1dff
SHA1

b72190a44238a46cbf838d0bfbfa90ddcf48fec6
SHA256

0e0b159fb42b06515c55e17eeba811fa4c46d87db89e821070b840303e063729
SHA512

10a5f3c19cd6502562d8425e50e14df54c3b52057a570504ce20813e118859250afb3a4041a2f4e81cd308cd4604de38653c0247badda8f463ca50dbe67485db

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2880	WerFault.exe
Token: SeBackupPrivilege	2880	WerFault.exe
Token: SeDebugPrivilege	2880	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1500	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\BTL GLOBAL LONG OVERDUE PAYMENT.exe
"C:\Users\Admin\AppData\Local\Temp\BTL GLOBAL LONG OVERDUE PAYMENT.exe"
1⤵
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 948
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/2880-1-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/2880-3-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download