Analysis
- max time kernel
65s - max time network
106s - platform
windows10_x64 - resource
win10v200430 - submitted
16/07/2020, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
Sinergy Group Order_pdf.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Sinergy Group Order_pdf.exe
Resource
win10v200430
0 signatures
0 seconds
General
- Target Sinergy Group Order_pdf.exe
- Size 562KB
- Sample200716-8bdfmlpm66
- SHA256 db05ef91ce6aab1caec17f4bbd8b89bdee50631e13f99ba4e0ccc3019d6af36f
- MD5 abc7640d0fac2646c3d2f5c290e56334
- SHA1 2db474ffcbc3b15cc5369c64304d07226d0c8750
- SHA512 9cccb80c46e3c41c4b3b3501be16d8e4e14c19c6a129538f3fc5eceb59249189ba249ef27f14b4fc26dcbbe563dee2e36aa1e253ad6a5c014636dcfc5e589138
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 2432 2564 WerFault.exe 65 - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2432 WerFault.exe Token: SeBackupPrivilege 2432 WerFault.exe Token: SeDebugPrivilege 2432 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sinergy Group Order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Sinergy Group Order_pdf.exe"1⤵PID:2564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 9122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432
-