7d55b0a9f323550b53b9bed20b938959163a3ab02b995a6d84d5e4b0145febb7 | Triage

Analysis

max time kernel
65s
max time network
105s
platform
windows10_x64
resource
win10v200430
submitted
16-07-2020 03:53

Sharing

Report Analysis Logs

General

Target

Original Shipping documents .pdf.exe
Size

497KB
MD5

b4c970d02853627e0895a727572788c7
SHA1

78c71acc984005bb0f7db63180dd3b3fa9673abb
SHA256

7d55b0a9f323550b53b9bed20b938959163a3ab02b995a6d84d5e4b0145febb7
SHA512

3f71519f1c105b49c538dd7b37e22207765c233809999eed8f786d834b023d85974d4fd4ba370e19f5843eefc454c5a88149985dacf9fee878315a41d3c7cc35

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2168	1008	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2168	WerFault.exe
Token: SeBackupPrivilege	2168	WerFault.exe
Token: SeDebugPrivilege	2168	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Original Shipping documents .pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Original Shipping documents .pdf.exe"
1⤵
PID:1008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 912
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download