7953cff779759642a2cd5981662769249457f01c0c996c69c0b80d5439860c6a | Triage

Analysis

max time kernel
137s
max time network
108s
platform
windows10_x64
resource
win10v200430
submitted
18-07-2020 08:48

Sharing

Report Analysis Logs

General

Target

Detalles del pago.pdf.exe
Size

908KB
MD5

cff942f8b8b7161e872910d0cc37d21c
SHA1

ff18633786e78743da40dee2c0af1c01c7119117
SHA256

7953cff779759642a2cd5981662769249457f01c0c996c69c0b80d5439860c6a
SHA512

d4cc80ce02e1f50f94b4f35b4b42df7cba7cb1f173581e0d6a650c65c29e183049a9046811445eeaba12ffad9e13a12c828f3e5e5653e7d69c1f1d74ef16988d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3968	992	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3968	WerFault.exe
Token: SeBackupPrivilege	3968	WerFault.exe
Token: SeDebugPrivilege	3968	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Detalles del pago.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Detalles del pago.pdf.exe"
1⤵
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1168
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3968-0-0x00000000046C0000-0x00000000046C1000-memory.dmp

Filesize
4KB

Download
memory/3968-1-0x00000000046C0000-0x00000000046C1000-memory.dmp

Filesize
4KB

Download
memory/3968-3-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/3968-4-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download