044c48fe42178958d8f55e5404e056ff0f1071d865deda9cc42518ab2c87fda7 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows10_x64
resource
win10
submitted
29-07-2020 06:24

Sharing

Report Analysis Logs

General

Target

LUSA TEX ORDER 07282020 .exe
Size

1.3MB
MD5

cbd2e0a042f3734b1b72543b3a55bd99
SHA1

e6b6ffe43795d6a4c6b3c60e1dbfe6b2d29333c6
SHA256

044c48fe42178958d8f55e5404e056ff0f1071d865deda9cc42518ab2c87fda7
SHA512

17a7f971ec908a19d0a0c8b9611caf7b0b3148a84723b3cf4d25d0a65b1a45341998a51286ad1dee31c9183010171311d4dd8c53ec603bfba61e37caedd8d10c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	3356	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2892	WerFault.exe
Token: SeBackupPrivilege	2892	WerFault.exe
Token: SeDebugPrivilege	2892	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\LUSA TEX ORDER 07282020 .exe
"C:\Users\Admin\AppData\Local\Temp\LUSA TEX ORDER 07282020 .exe"
1⤵
PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1184
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/2892-1-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/2892-3-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download