929b3de95bbd633a33db18a4099536fb5e22698d59ebe9588eb927f0aaef01da | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10_x64
resource
win10v200722
submitted
31-07-2020 17:34

Sharing

Report Analysis Logs

General

Target

purchase items.exe
Size

460KB
MD5

327559d02c47e83c76176801e5d61e82
SHA1

cdf282cfc1551e3833bc373f4d856921b89d2f3b
SHA256

929b3de95bbd633a33db18a4099536fb5e22698d59ebe9588eb927f0aaef01da
SHA512

bccfc8ff67dfbaa5e301e71dfacfbdd57e6025941df83fcb6a83ec1ef6b5b20a0cebf3ed633b7f36fe731611b39129c8735ae95efa34150f7f5eac0fbba926c9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1844 3740 WerFault.exe purchase items.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe
1844	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1844 WerFault.exe
Token: SeBackupPrivilege 1844 WerFault.exe
Token: SeDebugPrivilege 1844 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\purchase items.exe
"C:\Users\Admin\AppData\Local\Temp\purchase items.exe"
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1172
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-0-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/1844-1-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download