3f4e15f0e6b88a297c868614ba450237dba01adf2ffa25b83c065dec46bc1edf | Triage™

Analysis

max time kernel
143s
max time network
94s
platform
windows10_x64
resource
win10v200722
submitted
30/07/2020, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ThursBisQuit.exe
Size 651KB
Sample200730-s7qpgjkerx
SHA256 3f4e15f0e6b88a297c868614ba450237dba01adf2ffa25b83c065dec46bc1edf
MD5 768a9fd5debbb33838521cbbe8994518
SHA1 bbbad82d1a8aa65c67620462f846108899d67f05
SHA512 1a7655da2ab5ccc2c26d79c9654af64b2953dd1d25433fac0f03db4745e43ba4948336e08b36ae3f46af85cf5ff89916c87ba4fc101e2e06c1851ac0094d550d
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3728	2584	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2584	ThursBisQuit.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe
3728	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	ThursBisQuit.exe
Token: SeRestorePrivilege	3728	WerFault.exe
Token: SeBackupPrivilege	3728	WerFault.exe
Token: SeDebugPrivilege	3728	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ThursBisQuit.exe
"C:\Users\Admin\AppData\Local\Temp\ThursBisQuit.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1288
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3728-0-0x0000000005050000-0x0000000005051000-memory.dmp

Download

memory/3728-1-0x0000000005880000-0x0000000005881000-memory.dmp

Download