e7f1edbadee13fa42d4ad8b0030dc5f326c942b55a29f122a8651260d7cbceb8 | Triage

Analysis

max time kernel
115s
max time network
122s
platform
windows7_x64
resource
win7
submitted
19-07-2020 19:45

Sharing

Report Analysis Logs

General

Target

zeus 1_1.2.4.3.vir.exe
Size

829KB
MD5

c486e97d4b2f5abbf08b01d584964f31
SHA1

435516e55e04d41163b8ce206321d8eaba471112
SHA256

e7f1edbadee13fa42d4ad8b0030dc5f326c942b55a29f122a8651260d7cbceb8
SHA512

89c1896d570129db10d701659068a96fe624e51bf688d3bb6602b4c2e04c218784764fcc098d76562f2051a996b229caf0f2a474197e7067225fe9423e37d948

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1276 WerFault.exe
1276 WerFault.exe
1276 WerFault.exe
1276 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 1316 WerFault.exe zeus 1_1.2.4.3.vir.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zeus 1_1.2.4.3.vir.exe

description	pid	process	target process
PID 1316 wrote to memory of 1276	1316	zeus 1_1.2.4.3.vir.exe	WerFault.exe
PID 1316 wrote to memory of 1276	1316	zeus 1_1.2.4.3.vir.exe	WerFault.exe
PID 1316 wrote to memory of 1276	1316	zeus 1_1.2.4.3.vir.exe	WerFault.exe
PID 1316 wrote to memory of 1276	1316	zeus 1_1.2.4.3.vir.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1276 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.4.3.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.4.3.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 36
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-0-0x0000000000000000-mapping.dmp

Download
memory/1276-1-0x0000000002110000-0x0000000002121000-memory.dmp

Filesize
68KB

Download
memory/1276-2-0x0000000002660000-0x0000000002671000-memory.dmp

Filesize
68KB

Download