Analysis
-
max time kernel
66s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 18:37
Static task
static1
Behavioral task
behavioral1
Sample
70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe
Resource
win10v20201028
General
-
Target
70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe
-
Size
705KB
-
MD5
0e441fdcdf825540b8b3754c13ea9374
-
SHA1
a5601a62f31d28b77b8a05e2d71963cd52860933
-
SHA256
70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509
-
SHA512
ef9d7febcdc4e018ba6044b4e49a9b5859a52c837bb7019cfbe69b97846d0b42b8dc60f091c497aba262883677d11263b51fd3023171a925fb6adb0ce3626d92
Malware Config
Signatures
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2832 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 1324 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 3592 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 972 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 1148 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 2160 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 400 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 3860 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 220 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 308 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 3552 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 2660 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe 204 3412 WerFault.exe 70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe -
Suspicious behavior: EnumeratesProcesses 188 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 3592 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 972 WerFault.exe 1148 WerFault.exe 1148 WerFault.exe 1148 WerFault.exe 1148 WerFault.exe 1148 WerFault.exe 1148 WerFault.exe 1148 WerFault.exe 1148 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 2832 WerFault.exe Token: SeBackupPrivilege 2832 WerFault.exe Token: SeDebugPrivilege 2832 WerFault.exe Token: SeDebugPrivilege 1324 WerFault.exe Token: SeDebugPrivilege 3592 WerFault.exe Token: SeDebugPrivilege 972 WerFault.exe Token: SeDebugPrivilege 1148 WerFault.exe Token: SeDebugPrivilege 2160 WerFault.exe Token: SeDebugPrivilege 400 WerFault.exe Token: SeDebugPrivilege 3860 WerFault.exe Token: SeDebugPrivilege 220 WerFault.exe Token: SeDebugPrivilege 308 WerFault.exe Token: SeDebugPrivilege 3552 WerFault.exe Token: SeDebugPrivilege 2660 WerFault.exe Token: SeDebugPrivilege 204 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe"C:\Users\Admin\AppData\Local\Temp\70f870ed828d99992912319f94b63069ba91a2ffc4f3d7bf4944ba0b4a42b509.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 8042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 9162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 10842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 10802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 10802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 11522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 12082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 14482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 14962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 13922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 16242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 14162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 14882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-182-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/204-179-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/220-94-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/220-91-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/308-101-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/308-95-0x00000000045F0000-0x00000000045F1000-memory.dmpFilesize
4KB
-
memory/400-86-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/400-83-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/972-18-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/972-22-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/1148-78-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/1148-75-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1324-11-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/1324-8-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/2160-82-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/2160-79-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/2660-178-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/2660-175-0x00000000045F0000-0x00000000045F1000-memory.dmpFilesize
4KB
-
memory/2832-5-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/2832-2-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/2832-3-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/3412-0-0x0000000002466000-0x0000000002467000-memory.dmpFilesize
4KB
-
memory/3412-12-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/3412-13-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/3412-1-0x0000000004060000-0x0000000004061000-memory.dmpFilesize
4KB
-
memory/3552-171-0x0000000004960000-0x0000000004961000-memory.dmpFilesize
4KB
-
memory/3552-174-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/3592-14-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/3592-17-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/3860-87-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/3860-90-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB