Analysis
-
max time kernel
129s -
max time network
132s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 12:09
Static task
static1
Behavioral task
behavioral1
Sample
NEW RFQ.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NEW RFQ.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
NEW RFQ.exe
-
Size
760KB
-
MD5
dac1de5239180e2069ab67c8a8e7c44b
-
SHA1
0d1400e85febc34131236e94aff353ff681be293
-
SHA256
49700ee70d04597630dacefa2203c0f12f412ece9a93ffdb09ab18e5cce00524
-
SHA512
5d23cc399dfb610b596f8c10065ff45f2d6e4d382325539abbd3566f4211ef305f231a68c762c484681a785d0d1e0384775e990b8e8e1f44ba240724eaa7b392
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3808 720 WerFault.exe NEW RFQ.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
NEW RFQ.exeWerFault.exepid process 720 NEW RFQ.exe 720 NEW RFQ.exe 720 NEW RFQ.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
NEW RFQ.exeWerFault.exedescription pid process Token: SeDebugPrivilege 720 NEW RFQ.exe Token: SeRestorePrivilege 3808 WerFault.exe Token: SeBackupPrivilege 3808 WerFault.exe Token: SeDebugPrivilege 3808 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW RFQ.exe"C:\Users\Admin\AppData\Local\Temp\NEW RFQ.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 9562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3808-0-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/3808-1-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/3808-3-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/3808-4-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB