51b758ec870caeca167e24b4e7da08a9628a99ac033823420d3e6ea204ec8e2c | Triage

Analysis

max time kernel
115s
max time network
123s
platform
windows10_x64
resource
win10
submitted
31-07-2020 13:25

Sharing

Report Analysis Logs

General

Target

Convite Do Tribunal.exe
Size

432KB
MD5

5eda5883dc925b61fb5dd03a86037930
SHA1

f891d472c8c54bd5419208f202cdacb71e17a97c
SHA256

51b758ec870caeca167e24b4e7da08a9628a99ac033823420d3e6ea204ec8e2c
SHA512

1745aeaca73fc2f39ff121ee0b79c718cea89b3fc69440095b59682d0358f61d0ad2bc1c520da1ca6dad1c30e1145be9de6417804b50c065816fe42647d5b96f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3016 3836 WerFault.exe Convite Do Tribunal.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe
3016	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3016 WerFault.exe
Token: SeBackupPrivilege 3016 WerFault.exe
Token: SeDebugPrivilege 3016 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Convite Do Tribunal.exe
"C:\Users\Admin\AppData\Local\Temp\Convite Do Tribunal.exe"
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1168
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x00000000049E0000-0x00000000049E1000-memory.dmp

Filesize
4KB

Download
memory/3016-1-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download