Downloads.rar

General
Target

CVWSHSetup[1].bin/WSHSetup[1].exe

Filesize

139MB

Completed

19-11-2020 10:40

Score
3 /10
Malware Config
Signatures 4

Filter: none

  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    1992984WerFault.exeWSHSetup[1].exe
  • NTFS ADS
    WSHSetup[1].exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\𘂯C:\Windows\SysWOW64WSHSetup[1].exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exe

    Reported IOCs

    pidprocess
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
    1992WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege1992WerFault.exe
    Token: SeBackupPrivilege1992WerFault.exe
    Token: SeDebugPrivilege1992WerFault.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe
    "C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe"
    NTFS ADS
    PID:984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 1512
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1992
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1992-0-0x0000000004550000-0x0000000004551000-memory.dmp

                          • memory/1992-1-0x0000000004940000-0x0000000004941000-memory.dmp

                          • memory/1992-2-0x0000000004D40000-0x0000000004D41000-memory.dmp