Downloads.rar

General
Target

WSHSetup[1].exe

Filesize

139MB

Completed

19-11-2020 10:40

Score
3 /10
Malware Config
Signatures 4

Filter: none

  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    32201192WerFault.exeWSHSetup[1].exe
  • NTFS ADS
    WSHSetup[1].exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\AppData\Local\Temp\¯C:\Windows\SysWOW64WSHSetup[1].exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exe

    Reported IOCs

    pidprocess
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
    3220WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege3220WerFault.exe
    Token: SeBackupPrivilege3220WerFault.exe
    Token: SeDebugPrivilege3220WerFault.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\WSHSetup[1].exe
    "C:\Users\Admin\AppData\Local\Temp\WSHSetup[1].exe"
    NTFS ADS
    PID:1192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 1524
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3220
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3220-0-0x0000000004C60000-0x0000000004C61000-memory.dmp

                          • memory/3220-1-0x0000000004C60000-0x0000000004C61000-memory.dmp

                          • memory/3220-3-0x0000000005490000-0x0000000005491000-memory.dmp