6e57b3151e696198fa799ccdc91d05ecee2462f5adc2ec5cd591b745165106e8 | Triage

Analysis

max time kernel
131s
max time network
133s
platform
windows10_x64
resource
win10
submitted
19-07-2020 19:34

Sharing

Report Analysis Logs

General

Target

iceix_1.2.5.0.vir.exe
Size

1.0MB
MD5

3b3b888bcc1668fbd561b500e1e78e37
SHA1

c958f983cdb6be45d7ad8d6a653ff1516b561e42
SHA256

6e57b3151e696198fa799ccdc91d05ecee2462f5adc2ec5cd591b745165106e8
SHA512

7117cade23b12e48b55b04c732027846e2f3d6450870fd413e93e665b7d29394287ca5a4871c00ad8c078a74a3eec341a38c2ba161e3274202c60380e6250f88

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3864 3676 WerFault.exe iceix_1.2.5.0.vir.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3864 WerFault.exe
Token: SeBackupPrivilege 3864 WerFault.exe
Token: SeDebugPrivilege 3864 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\iceix_1.2.5.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\iceix_1.2.5.0.vir.exe"
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1128
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3676-1-0x00000000021C0000-0x00000000021C4000-memory.dmp

Filesize
16KB

Download
memory/3864-2-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/3864-3-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download