Analysis
-
max time kernel
75s -
max time network
118s -
platform
windows10_x64 -
resource
win10 -
submitted
16-07-2020 12:41
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT ADVICE.pdf.htm.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PAYMENT ADVICE.pdf.htm.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
PAYMENT ADVICE.pdf.htm.exe
-
Size
566KB
-
MD5
c4df328f52522f048ca32b7e479fc0ac
-
SHA1
cbb4726598aa012f15ee5191b434f8d29d54851a
-
SHA256
75bf8cf9e7b9b06f08396a6d6ecf3bca428c00cd79e4b9bf6e56619b67d7c4de
-
SHA512
d5908f6e07f25e108c34ea23eae68d76d2d77df9cf4bde346c94b4d9037ffac5ff1387250d42b8721e2a7a3e617ef1b2a01c08e444509fafbed267cdbf76ee51
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3240 3100 WerFault.exe PAYMENT ADVICE.pdf.htm.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3240 WerFault.exe Token: SeBackupPrivilege 3240 WerFault.exe Token: SeDebugPrivilege 3240 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.pdf.htm.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.pdf.htm.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 9082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken