f61ea2b82ddad99865b46c4a79b1f0e54c7ed82389fc3bbe5e346310b47f6355 | Triage

Analysis

max time kernel
143s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
31-07-2020 10:55

Sharing

Report Analysis Logs

General

Target

TNT DOCUMENT.exe
Size

507KB
MD5

75149b45dbd194d67dd279d0b322bdf8
SHA1

074f248b7f169d44b31dd38a348fdf08e5bad6a3
SHA256

f61ea2b82ddad99865b46c4a79b1f0e54c7ed82389fc3bbe5e346310b47f6355
SHA512

5bfe7bc12f36d56eb92e7eb85229e1fd7f31503f7a25c23dd33529d77ba94d47a3110f188ce979dfaaaaefbb38b39aa73ccd7ee322569decf6c4a40e4300e31f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4080 2584 WerFault.exe TNT DOCUMENT.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe
4080	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4080 WerFault.exe
Token: SeBackupPrivilege 4080 WerFault.exe
Token: SeDebugPrivilege 4080 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\TNT DOCUMENT.exe
"C:\Users\Admin\AppData\Local\Temp\TNT DOCUMENT.exe"
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1176
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4080-0-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/4080-1-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download