84233ce927b293c6d092695bef42d0ab5dc55f53b76d0818ae574486bafb7b98 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows10_x64
resource
win10v200722
submitted
31-07-2020 11:09

Sharing

Report Analysis Logs

General

Target

SHIPMENT DETAILS.exe
Size

506KB
MD5

387938582350a94e786a703ecdb5897c
SHA1

9448ee73ad95c7dd3a083de1b491815189e9d11c
SHA256

84233ce927b293c6d092695bef42d0ab5dc55f53b76d0818ae574486bafb7b98
SHA512

00b17eb7adffc63ed21e82581a2c9216473db803777d9641d2dc05d8df194182d4c50333ad0e816eadb662d44edef839ff7439f2c80c6a4712db522881f899ce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2656 2080 WerFault.exe SHIPMENT DETAILS.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2656 WerFault.exe
Token: SeBackupPrivilege 2656 WerFault.exe
Token: SeDebugPrivilege 2656 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SHIPMENT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPMENT DETAILS.exe"
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 1172
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/2656-1-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/2656-2-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download