Resubmissions
09-11-2020 20:18
201109-ml81e7b676 3Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:18
Static task
static1
0 signatures
0 seconds
0 signatures
0 seconds
General
-
Target
-
Size
2.0MB
-
MD5
5009b8bcf024704c8b23e42c492f118c
-
SHA1
df607367a88b5610a224909efb8debeb0d90f487
-
SHA256
30f099660904079afcd445409cfd2eca735fab49dda522f03ed60d47f9f21bdc
-
SHA512
70c4d7c6b9124246def27e28b69f2eb30bac85a5c0e8b38cf593222bec02c561143ebf0995946d1c30ef5441a6152cf587ef2d70651482374017a321df1c8e3b
Score
3/10
Malware Config
Signatures
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1004 3936 WerFault.exe [email protected] 2740 3936 WerFault.exe [email protected] 748 3936 WerFault.exe [email protected] 1208 3936 WerFault.exe [email protected] 2108 3936 WerFault.exe [email protected] 1256 3936 WerFault.exe [email protected] 1248 3936 WerFault.exe [email protected] -
Suspicious behavior: EnumeratesProcesses 91 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 748 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 1208 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe 2108 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 1004 WerFault.exe Token: SeBackupPrivilege 1004 WerFault.exe Token: SeDebugPrivilege 1004 WerFault.exe Token: SeDebugPrivilege 2740 WerFault.exe Token: SeDebugPrivilege 748 WerFault.exe Token: SeDebugPrivilege 1208 WerFault.exe Token: SeDebugPrivilege 2108 WerFault.exe Token: SeDebugPrivilege 1256 WerFault.exe Token: SeDebugPrivilege 1248 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 9002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 11882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 12162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 13562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-9-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/748-12-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/1004-1-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/1004-0-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/1208-13-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/1208-14-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/1248-26-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/1248-23-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/1256-19-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/1256-22-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/2108-18-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/2108-17-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/2740-8-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/2740-5-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB