f92625cc11494c0c5d265ed331354338c45c05658323cfae8ff4a8099351ae05 | Triage

Analysis

max time kernel
125s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:26

Sharing

Report Analysis Logs

General

Target

grabbot_0.1.5.5.vir.exe
Size

361KB
MD5

7ec0decf55d3ce9bf112ca4bdcb7db02
SHA1

a7e40979878f0afb813a429f3d644cebe257740e
SHA256

f92625cc11494c0c5d265ed331354338c45c05658323cfae8ff4a8099351ae05
SHA512

81cc2986d1c2f1f395e78f772c92ae4cd8253ba365a73433ce61615d02349f652530704c76bd046ebf135615ef5fcf727aea4d42cffded511312d541bfb464dc

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 952 WerFault.exe
Token: SeBackupPrivilege 952 WerFault.exe
Token: SeDebugPrivilege 952 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe
952	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

952 1628 WerFault.exe grabbot_0.1.5.5.vir.exe

C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.5.5.vir.exe
"C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.5.5.vir.exe"
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 276
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-0-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/952-2-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download