93c807a2fb8dff5a30d9f860f1eb98304d8303f8fff4c53c98870201d6d3eb68 | Triage

Analysis

max time kernel
69s
max time network
121s
platform
windows10_x64
resource
win10
submitted
16/07/2020, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

overdue invoice.pdf...exe
Size

539KB
MD5

fa0c9ce3695691566ec8fbba088433c6
SHA1

1b5693cbe7521087c8bb5b46a8706edb71b037a4
SHA256

93c807a2fb8dff5a30d9f860f1eb98304d8303f8fff4c53c98870201d6d3eb68
SHA512

b3bb49000f13d18163d685905384b7acbca9b165cc009b53830c7f567b5c9f762fb6c6d1c08036db774265c1048d3e62b6ca198253a37a8a5a19adcffac4c57a

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3380	WerFault.exe
Token: SeBackupPrivilege	3380	WerFault.exe
Token: SeDebugPrivilege	3380	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3380	3100	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\overdue invoice.pdf...exe
"C:\Users\Admin\AppData\Local\Temp\overdue invoice.pdf...exe"
1⤵
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 908
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-0-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3380-1-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3380-3-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download