6680a475582eb69a5bf028ebe5ae4ebd808e5da535336f0b0fe8a7ae6fe77a60 | Triage

Analysis

max time kernel
62s
max time network
22s
platform
windows7_x64
resource
win7
submitted
19-07-2020 19:22

Sharing

Report Analysis Logs

General

Target

zeus 1_1.2.7.21.vir.exe
Size

108KB
MD5

03abab3227f438e805e72e4c8325086a
SHA1

5884b783f31cbfaa7726ce018b23eaa6ba124692
SHA256

6680a475582eb69a5bf028ebe5ae4ebd808e5da535336f0b0fe8a7ae6fe77a60
SHA512

97c0c455c58ec33e52d736749f5b718264d9963009d788c06813b7198b14d0e44f6f34609134992ee0452e1216d69068af3169babb2e98f9e41dab2262322fe6

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1092 WerFault.exe
1092 WerFault.exe
1092 WerFault.exe
1092 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 1088 WerFault.exe zeus 1_1.2.7.21.vir.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zeus 1_1.2.7.21.vir.exe

description	pid	process	target process
PID 1088 wrote to memory of 1092	1088	zeus 1_1.2.7.21.vir.exe	WerFault.exe
PID 1088 wrote to memory of 1092	1088	zeus 1_1.2.7.21.vir.exe	WerFault.exe
PID 1088 wrote to memory of 1092	1088	zeus 1_1.2.7.21.vir.exe	WerFault.exe
PID 1088 wrote to memory of 1092	1088	zeus 1_1.2.7.21.vir.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1092 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.21.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.2.7.21.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 156
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-0-0x0000000000000000-mapping.dmp

Download
memory/1092-1-0x0000000001E90000-0x0000000001EA1000-memory.dmp

Filesize
68KB

Download
memory/1092-2-0x00000000024F0000-0x0000000002501000-memory.dmp

Filesize
68KB

Download