a550b01785417d0c802740cb128aa26d4415414458b87877b634bed5c2694ad5 | Triage

Analysis

max time kernel
66s
max time network
110s
platform
windows10_x64
resource
win10
submitted
31-07-2020 09:26

Sharing

Report Analysis Logs

General

Target

KHFOPL.exe
Size

329KB
MD5

bbea4121c22c72511cd75c29fc4f2dcd
SHA1

89a363f16b4357c82a9d5c280a6d1c970a936f28
SHA256

a550b01785417d0c802740cb128aa26d4415414458b87877b634bed5c2694ad5
SHA512

cd1fd7e1555c6844cb7e38d3f5962a33f4eb08ab1459c4f29ebe69d0feb5946e0f3a06136bca923e30bc2943000b8cfdde26b523694020b267e1fb716abfc81e

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

416 2984 WerFault.exe KHFOPL.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 416 WerFault.exe
Token: SeBackupPrivilege 416 WerFault.exe
Token: SeDebugPrivilege 416 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\KHFOPL.exe
"C:\Users\Admin\AppData\Local\Temp\KHFOPL.exe"
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1168
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-0-0x0000000004070000-0x0000000004071000-memory.dmp

Filesize
4KB

Download
memory/416-1-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download