a543d22347f54870ae7dc14964a0242bfee089214c900abe01d1da6e2fcea6cc | Triage

Analysis

max time kernel
68s
max time network
119s
platform
windows10_x64
resource
win10
submitted
17-07-2020 16:34

Sharing

Report Analysis Logs

General

Target

MY_self_cryped.exe
Size

1.2MB
MD5

cb0da230201048ec24ca733146c9d3ca
SHA1

fd5789a808f2d601640c591a47d2e7a31759d78f
SHA256

a543d22347f54870ae7dc14964a0242bfee089214c900abe01d1da6e2fcea6cc
SHA512

e3ce4a25725de7668d837a446b0978d2da51e50b591b28097f466c36ff9c42cb475ed58f4424cde31e99523dbaa12c3e7e1c8930a10eb9f5b90239651e28e7a8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1536	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	MY_self_cryped.exe
Token: SeRestorePrivilege	1788	WerFault.exe
Token: SeBackupPrivilege	1788	WerFault.exe
Token: SeDebugPrivilege	1788	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1536	MY_self_cryped.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MY_self_cryped.exe
"C:\Users\Admin\AppData\Local\Temp\MY_self_cryped.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1124
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-0-0x0000000004650000-0x0000000004651000-memory.dmp

Filesize
4KB

Download