6288d889b584dc17232b26e33cd12f5fda5caa110cfd52836df3b13306b46ca8 | Triage

Analysis

max time kernel
138s
max time network
62s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:38

Sharing

Report Analysis Logs

General

Target

zeus 1_1.3.0.26.vir.exe
Size

2.7MB
MD5

7e37173f76f3515e4e57245db0387efe
SHA1

455734c36e47236908b8264430025ebd14a13398
SHA256

6288d889b584dc17232b26e33cd12f5fda5caa110cfd52836df3b13306b46ca8
SHA512

93ca9b66850bba875438b86f0d9e13f45fee17df0f182b062a20c6e3d3de36e6ee3e86e28dd25dac644b8b5285adb2959f39060234cc72eb0edea39cd5fa687c

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

528 3656 WerFault.exe zeus 1_1.3.0.26.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 528 WerFault.exe
Token: SeBackupPrivilege 528 WerFault.exe
Token: SeDebugPrivilege 528 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 1_1.3.0.26.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 1_1.3.0.26.vir.exe"
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 272
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-0-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/528-1-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/528-3-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/528-4-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download