90274fe07453dc76d41714cb2ff2b3a19874c326f5f137f60f6cc1cc40bbb671 | Triage™

Analysis

max time kernel
125s
max time network
128s
platform
windows10_x64
resource
win10
submitted
22/07/2020, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file34k7nj2kMxshqVTjY-order22-07.exe
Size 462KB
Sample200722-ew8nwllpke
SHA256 90274fe07453dc76d41714cb2ff2b3a19874c326f5f137f60f6cc1cc40bbb671
MD5 4652c8b8ec050983599a557d23ef4328
SHA1 4ba9cd86be2ef67ecb7b6eea5eec1c90b07af618
SHA512 6eea11557c4aae103e71de974f3bc301b0b6037b91423ecb3e513001e4e4c934b6b7e9835b9dc1cf941783dfb5c514e9c97ef01ff5783b1861c9b17d22c6aaf7
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3856	2728	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3856	WerFault.exe
Token: SeBackupPrivilege	3856	WerFault.exe
Token: SeDebugPrivilege	3856	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file34k7nj2kMxshqVTjY-order22-07.exe
"C:\Users\Admin\AppData\Local\Temp\file34k7nj2kMxshqVTjY-order22-07.exe"
1⤵
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 904
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x0000000004340000-0x0000000004341000-memory.dmp

Download