ae68aa53a27732eb0803f205fee19d3ca3e8bce7c0ac03d3fb30ab89a46626de | Triage

Analysis

max time kernel
119s
max time network
117s
platform
windows10_x64
resource
win10
submitted
19-07-2020 19:25

Sharing

Report Analysis Logs

General

Target

zeus 2_2.0.3.1.vir.exe
Size

149KB
MD5

a4fad2f8844d008eea0519128c5145e4
SHA1

752fbb7202fde75f4210710db567bbd337f80d93
SHA256

ae68aa53a27732eb0803f205fee19d3ca3e8bce7c0ac03d3fb30ab89a46626de
SHA512

86122cff5375ed64dbc9319a94698f9029a96e4379cd37742556da05f9d4a71eeefe52383cbe978af3d6e1a60e65352d85d14c2844bd4eee6d8af6f959f0a99d

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3864 3576 WerFault.exe zeus 2_2.0.3.1.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3864 WerFault.exe
Token: SeBackupPrivilege 3864 WerFault.exe
Token: SeDebugPrivilege 3864 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.3.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\zeus 2_2.0.3.1.vir.exe"
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 408
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3864-0-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/3864-1-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download