45b93bb13395c8a791fe0eaa763bd84e963a5b7a8bc348cfd1230004cf080e3b | Triage™

Analysis

max time kernel
123s
max time network
129s
platform
windows10_x64
resource
win10
submitted
31/07/2020, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
statement.exe
Size 723KB
Sample200731-htx3ay64ba
SHA256 45b93bb13395c8a791fe0eaa763bd84e963a5b7a8bc348cfd1230004cf080e3b
MD5 b8f076670ddf9a95d96969270ea0c1fc
SHA1 f6a3c3fcb3ff3b5ec1f5d50316d9d2ddd33ebc2f
SHA512 67e80f1f81c384ab46c980539c291c51b4e7f11251e3c34d866c10b560794770ff7bbe0275f68fdd41878f40de69481e7390218956f07eba2c38eef8000ec4f9
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	792	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
792	statement.exe
792	statement.exe
792	statement.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe
996	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	statement.exe
Token: SeRestorePrivilege	996	WerFault.exe
Token: SeBackupPrivilege	996	WerFault.exe
Token: SeDebugPrivilege	996	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\statement.exe
"C:\Users\Admin\AppData\Local\Temp\statement.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 964
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-0-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/996-1-0x0000000005630000-0x0000000005631000-memory.dmp

Download