7543c6fd163cc67f5bf477b5b583bfca5c094e65c6a5d5dea56e3eeb333b1cad | Triage™

Analysis

max time kernel
69s
max time network
117s
platform
windows10_x64
resource
win10
submitted
05/08/2020, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kash.exe
Size 382KB
Sample200805-tmna65pgse
SHA256 7543c6fd163cc67f5bf477b5b583bfca5c094e65c6a5d5dea56e3eeb333b1cad
MD5 1968eb3e1db96fcc509cf0916e35b13d
SHA1 87a8ca997533df78445c497d637451062ae289ee
SHA512 836ba975af74a4265d7d4943971648084e4b24e1e1e9278fe9dd09e6c071163249ba26ffde05dab3e14d36a6a44c69985016631228cac69984965ea77c6c84de
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	kash.exe
Token: SeRestorePrivilege	3796	WerFault.exe
Token: SeBackupPrivilege	3796	WerFault.exe
Token: SeDebugPrivilege	3796	WerFault.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3620	kash.exe
3620	kash.exe
3620	kash.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe
3796	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	3620	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\kash.exe
"C:\Users\Admin\AppData\Local\Temp\kash.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 956
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3796-0-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/3796-1-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/3796-2-0x0000000005050000-0x0000000005051000-memory.dmp

Download