c8e97577eeb35634eecb4cc3b4917d2f851691bf318ed79b298eb3830c641a01 | Triage

Analysis

max time kernel
140s
max time network
143s
platform
windows10_x64
resource
win10
submitted
18-07-2020 08:47

Sharing

Report Analysis Logs

General

Target

PO. RFQ-FSTG-20200017.pdf.exe
Size

887KB
MD5

c952993c6db15d8b032a17afbae99694
SHA1

6511607ac99965f5b2395c3af8d6219eab59f856
SHA256

c8e97577eeb35634eecb4cc3b4917d2f851691bf318ed79b298eb3830c641a01
SHA512

f723892f8022748f8e6961bb40918c28aff56a93aee1b302a7ca54b6eeef4663535373271e12f422fd9af2808933947fe55abe9da9d626b43b3b4ad733455780

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	3588	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3800	WerFault.exe
Token: SeBackupPrivilege	3800	WerFault.exe
Token: SeDebugPrivilege	3800	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO. RFQ-FSTG-20200017.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO. RFQ-FSTG-20200017.pdf.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1156
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-0-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3800-1-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download