95574ab20f094a30ec1f5d3cd6694e6afd0a5c4809e0151f5bd2b427bbbb33df | Triage

Analysis

max time kernel
66s
max time network
116s
platform
windows10_x64
resource
win10
submitted
16-07-2020 07:17

Sharing

Report Analysis Logs

General

Target

order.exe
Size

503KB
MD5

a280142137b1aeb5e45c793e2ab317dc
SHA1

ba95a539e94f0a82f2140522902d770730e76aaa
SHA256

95574ab20f094a30ec1f5d3cd6694e6afd0a5c4809e0151f5bd2b427bbbb33df
SHA512

c52605c490dce8d9e98bfa5a28d68a738e5ff3e817820439e0bb86c5d07a556c5df5df640e5527f0da33e8b0557ae547c2cc9b8d2d0460ceb6baf151764b6f37

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3864	2728	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3864	WerFault.exe
Token: SeBackupPrivilege	3864	WerFault.exe
Token: SeDebugPrivilege	3864	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 908
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3864-0-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/3864-1-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/3864-3-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download