74f0abd5013240cc7c7907544e081c7331c278356e5a0d7a9f5add4105734611 | Triage

Analysis

max time kernel
109s
max time network
112s
platform
windows10_x64
resource
win10
submitted
31-07-2020 11:47

Sharing

Report Analysis Logs

General

Target

swift advice Ref[GLV501756103].exe
Size

499KB
MD5

3c29248e3d6885fdbc7918485def416b
SHA1

d519b85de73a25025bc3fe0b89178a320feb38f8
SHA256

74f0abd5013240cc7c7907544e081c7331c278356e5a0d7a9f5add4105734611
SHA512

2ddf3ad3e75d9cd114e60eb0e7ca681f71d2b4a4e841d9c4446c0488b0b5d5e23dfd6ef285d25768890f1cde1cac0383c4c09b17d657aa113013c1bd79b80cbe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3888 4012 WerFault.exe swift advice Ref[GLV501756103].exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3888 WerFault.exe
Token: SeBackupPrivilege 3888 WerFault.exe
Token: SeDebugPrivilege 3888 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\swift advice Ref[GLV501756103].exe
"C:\Users\Admin\AppData\Local\Temp\swift advice Ref[GLV501756103].exe"
1⤵
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 1168
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3888-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3888-1-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download