e0d7c01881a50147f93ec0cec80b257bc05fed7a248eba2f2bc03a26e94c3129 | Triage

Analysis

max time kernel
133s
max time network
68s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:43

Sharing

Report Analysis Logs

General

Target

zeus 2_2.0.8.7.vir.exe
Size

167KB
MD5

e34aa6622bf3aa5756056b33dfe10c51
SHA1

ff4e3404180790b539934e965fb11a6738ae5796
SHA256

e0d7c01881a50147f93ec0cec80b257bc05fed7a248eba2f2bc03a26e94c3129
SHA512

9558aaa77de25433ae6fed69d0ca6911b7c1fdf8e3d819a787292f75d20462b8830352dc52b3387187913f20a74a055b4f8527e8523ca96cb66ff0b584d9b4ab

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe
1500	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1500 896 WerFault.exe zeus 2_2.0.8.7.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1500 WerFault.exe
Token: SeBackupPrivilege 1500 WerFault.exe
Token: SeDebugPrivilege 1500 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.7.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.8.7.vir.exe"
1⤵
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 528
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-0-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download