d96ee923cda8458627c393925aebc1f908ab6a40ebe8c9ea0f049e3edf27bce2 | Triage

Analysis

max time kernel
116s
max time network
118s
platform
windows10_x64
resource
win10
submitted
31-07-2020 08:29

Sharing

Report Analysis Logs

General

Target

tgwqjo.exe
Size

831KB
MD5

c9bdb2a0214fd34e21c9671da4bbbca4
SHA1

bd33a69c8926f4fd9747e9db063fcbae1e964bd5
SHA256

d96ee923cda8458627c393925aebc1f908ab6a40ebe8c9ea0f049e3edf27bce2
SHA512

5dd32f148634462317316e6ddcfdbe92d59a730dbd1949b68304bf2810d1a2075c273aaf29c7f6b2552273f03326274d56989d02c2e42f899ee5f79b702d4413

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1960 3848 WerFault.exe tgwqjo.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

tgwqjo.exeWerFault.exe

pid	process
3848	tgwqjo.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tgwqjo.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3848	tgwqjo.exe
Token: SeRestorePrivilege	1960	WerFault.exe
Token: SeBackupPrivilege	1960	WerFault.exe
Token: SeDebugPrivilege	1960	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tgwqjo.exe
"C:\Users\Admin\AppData\Local\Temp\tgwqjo.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 1316
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-0-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/1960-1-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/1960-3-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download