8c254637c5c98fe6755a44e5ea6feba18d0a17c4ad53e8d791277390060c29e5 | Triage

Analysis

max time kernel
61s
max time network
112s
platform
windows10_x64
resource
win10
submitted
16/07/2020, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

News-Update.scr
Size

566KB
MD5

8db27a63baec87e325fe3245f6778790
SHA1

c639dd9daf6f010142a37ef1fac0fbd8a00c3efd
SHA256

8c254637c5c98fe6755a44e5ea6feba18d0a17c4ad53e8d791277390060c29e5
SHA512

423c2b2d5400079f21025c5c2f0242aba1aeaa3fd9844b06678246e20fc65ae027dbad161ddbb2be10ca61fa992903b21e0d29cd3c415145b760e047377c1201

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3804	WerFault.exe
Token: SeBackupPrivilege	3804	WerFault.exe
Token: SeDebugPrivilege	3804	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe
3804	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3804	1588	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\News-Update.scr
"C:\Users\Admin\AppData\Local\Temp\News-Update.scr" /S
1⤵
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 928
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3804-0-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/3804-1-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/3804-3-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/3804-5-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download