ba4c584519a8fa8a90a906dea86ebe75bb3464190a152467d32ebdefcfc4e643 | Triage™

Analysis

max time kernel
140s
max time network
95s
platform
windows10_x64
resource
win10v200722
submitted
30/07/2020, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Products description.exe
Size 603KB
Sample200730-7jqyc476a6
SHA256 ba4c584519a8fa8a90a906dea86ebe75bb3464190a152467d32ebdefcfc4e643
MD5 19987543a96c675d45ac4e7212d2f465
SHA1 983555e698609ff5aee11137982545b2281679ec
SHA512 ff1a504fa8af3947a6e6a764b1a15827a24980134522cafbb9b75efe8427d057d8b61ffd511ea5dc69afc51355c5f5b28f27d72fbe5c85576bbc169e89e01e6e
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	3984	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3984	Products description.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe
2636	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	Products description.exe
Token: SeRestorePrivilege	2636	WerFault.exe
Token: SeBackupPrivilege	2636	WerFault.exe
Token: SeDebugPrivilege	2636	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Products description.exe
"C:\Users\Admin\AppData\Local\Temp\Products description.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1304
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-0-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/2636-1-0x0000000005760000-0x0000000005761000-memory.dmp

Download