2647f35410168d2018a29f65b10dad4cf7016b883b4ff303dabac68521b76e88 | Triage

Analysis

max time kernel
140s
max time network
35s
platform
windows7_x64
resource
win7v200430
submitted
19-07-2020 17:26

Sharing

Report Analysis Logs

General

Target

zeus 1_1.2.8.1.vir.exe
Size

80KB
MD5

89ff2386c1e4b7999bd9017469b8d1f9
SHA1

2081e011694ea3b1388cde509027314e2ae4b3d2
SHA256

2647f35410168d2018a29f65b10dad4cf7016b883b4ff303dabac68521b76e88
SHA512

77c5dba022c0779651df7866202a16978cd56481043e5d45ea4ab5740f50a82c94cf5971bdf477a0db198006b226781a4b34f143affda7694dda76dde55f5ec9

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1292 WerFault.exe
1292 WerFault.exe
1292 WerFault.exe
1292 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1292 828 WerFault.exe zeus 1_1.2.8.1.vir.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zeus 1_1.2.8.1.vir.exe

description	pid	process	target process
PID 828 wrote to memory of 1292	828	zeus 1_1.2.8.1.vir.exe	WerFault.exe
PID 828 wrote to memory of 1292	828	zeus 1_1.2.8.1.vir.exe	WerFault.exe
PID 828 wrote to memory of 1292	828	zeus 1_1.2.8.1.vir.exe	WerFault.exe
PID 828 wrote to memory of 1292	828	zeus 1_1.2.8.1.vir.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1292 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.8.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.8.1.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 88
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-0-0x0000000000000000-mapping.dmp

Download
memory/1292-1-0x0000000001EE0000-0x0000000001EF1000-memory.dmp

Filesize
68KB

Download
memory/1292-2-0x0000000002560000-0x0000000002571000-memory.dmp

Filesize
68KB

Download