866de889c68e9b0147480544b7e312decbe5483c1162fe3d205f85aeeb8e75a4 | Triage

Analysis

max time kernel
82s
max time network
110s
platform
windows10_x64
resource
win10v200722
submitted
31-07-2020 09:55

Sharing

Report Analysis Logs

General

Target

Akbank Hesap Özetiniz.exe
Size

774KB
MD5

6e5b122d49f7779416f98647230dd407
SHA1

894a4deadb0adac01a70e2611153a6a2a556118a
SHA256

866de889c68e9b0147480544b7e312decbe5483c1162fe3d205f85aeeb8e75a4
SHA512

7f3dca82a9181db925f3985fe7588755113e610253022b1478ec9e037f5745a4fa0d6531e4ae8df3cd5a4e6960c6a0b46653b346e6e08ac47abca50fdf317bb0

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

Akbank Hesap Özetiniz.exeWerFault.exe

pid	process
3740	Akbank Hesap Özetiniz.exe
3740	Akbank Hesap Özetiniz.exe
3740	Akbank Hesap Özetiniz.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe
1452	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1452 3740 WerFault.exe Akbank Hesap Özetiniz.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Akbank Hesap Özetiniz.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3740	Akbank Hesap Özetiniz.exe
Token: SeRestorePrivilege	1452	WerFault.exe
Token: SeBackupPrivilege	1452	WerFault.exe
Token: SeDebugPrivilege	1452	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Akbank Hesap Özetiniz.exe
"C:\Users\Admin\AppData\Local\Temp\Akbank Hesap Özetiniz.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 956
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-0-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/1452-1-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/1452-3-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download