5bf9c6dd99a8c7ee59efcf09ff2b4ee5b5f51aab9ad91cd2aa0fca4b0ae975ba | Triage

Analysis

max time kernel
129s
max time network
94s
platform
windows10_x64
resource
win10v200430
submitted
18-07-2020 07:55

Sharing

Report Analysis Logs

General

Target

Doc#162020094753525765344650094480.pdf.exe
Size

4.7MB
MD5

ffceee8b1fe197a9cac46ae74a66bccd
SHA1

806284efb14a8a27f44eee9564957659eec05282
SHA256

5bf9c6dd99a8c7ee59efcf09ff2b4ee5b5f51aab9ad91cd2aa0fca4b0ae975ba
SHA512

9d1cb0248107409eac2def450ebc99173e67340ee79a6f62c9b8273e318b0c17b53f914f122bb79d02f55af86516852100996c5152b5e15917a6c490c53e7627

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	Doc#162020094753525765344650094480.pdf.exe
Token: SeRestorePrivilege	3612	WerFault.exe
Token: SeBackupPrivilege	3612	WerFault.exe
Token: SeDebugPrivilege	3612	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1612	Doc#162020094753525765344650094480.pdf.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe
3612	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3612	1612	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\Doc#162020094753525765344650094480.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Doc#162020094753525765344650094480.pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1296
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3612-0-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3612-1-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3612-3-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download