d68a3fdd922868d3886be6c90f18cf232a0051b68f8232f67743e5b8df0ee914 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows10_x64
resource
win10
submitted
31-07-2020 10:05

Sharing

Report Analysis Logs

General

Target

AWB & Invoice -TNT Shipment.exe
Size

772KB
MD5

e4a5d743052e9e0c567269b98edda3b9
SHA1

cebdbcdcac76701fa99761930e8c80c21d03059e
SHA256

d68a3fdd922868d3886be6c90f18cf232a0051b68f8232f67743e5b8df0ee914
SHA512

5eb13cf59fd28235f23c0ccef7ce33db109daaadc9d7f6c3f81ba3891f7fe48193bf5119f11db1e637492eaf5567b67fcb4d87600981828024c30c2e75eaba35

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

AWB & Invoice -TNT Shipment.exeWerFault.exe

pid	process
3024	AWB & Invoice -TNT Shipment.exe
3024	AWB & Invoice -TNT Shipment.exe
3024	AWB & Invoice -TNT Shipment.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3896 3024 WerFault.exe AWB & Invoice -TNT Shipment.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AWB & Invoice -TNT Shipment.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3024	AWB & Invoice -TNT Shipment.exe
Token: SeRestorePrivilege	3896	WerFault.exe
Token: SeBackupPrivilege	3896	WerFault.exe
Token: SeDebugPrivilege	3896	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\AWB & Invoice -TNT Shipment.exe
"C:\Users\Admin\AppData\Local\Temp\AWB & Invoice -TNT Shipment.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 956
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3896-0-0x0000000004540000-0x0000000004541000-memory.dmp

Filesize
4KB

Download
memory/3896-1-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download