5d29cc33d90b21321625dca2d097b4d5015b1f4ff955422ea0c51442ac27e1e3 | Triage

Analysis

max time kernel
117s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:53

Sharing

Report Analysis Logs

General

Target

uncategorized_2.0.2.1.vir.exe
Size

129KB
MD5

b2dc0bf15f4334f8a6fa26a7b42cd371
SHA1

9718e1ce431f1a7e460d4e48c9ba9fd3bcf8e0f9
SHA256

5d29cc33d90b21321625dca2d097b4d5015b1f4ff955422ea0c51442ac27e1e3
SHA512

13cd5fddfd5acea0b194dc53d18e6f183edf4da105130f0183f13d3241dd07ebd54171b541340a71caec082bf2793ee64fb4f195cfad57def7d9a1540f6931a6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2148 1820 WerFault.exe uncategorized_2.0.2.1.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2148 WerFault.exe
Token: SeBackupPrivilege 2148 WerFault.exe
Token: SeDebugPrivilege 2148 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe
2148	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\uncategorized_2.0.2.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\uncategorized_2.0.2.1.vir.exe"
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 364
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download