f9cf0fafb332a52c2d95e3d18ad6b0f3d7836166fb105cb38970bec2bddd1daa | Triage

Analysis

max time kernel
89s
max time network
109s
platform
windows10_x64
resource
win10v20201028
submitted
26-12-2020 20:02

Sharing

Report Analysis Logs

General

Target

SUNBURST/FireEyeTools/078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c.dll
Size

14KB
MD5

5125979110847d35a338caac6bff2aa8
SHA1

218651ac5b575c3f9642c2e9a5928aa22fab8483
SHA256

078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c
SHA512

a19ceab78ee6d84ee1b8d42118e428f4f2e4b4500081fe8e1c38beed5386a692149113af01577e8f7b95034f2f2610be097385313bcb87d409470b78010bb369

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3268 1808 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3268 WerFault.exe
Token: SeBackupPrivilege 3268 WerFault.exe
Token: SeDebugPrivilege 3268 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 8 wrote to memory of 1808	8	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 1808	8	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 1808	8	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SUNBURST\FireEyeTools\078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\SUNBURST\FireEyeTools\078403b4e89ff06d2fe2ed7e75428a381f83ffb708dbd01b0220767498947f0c.dll
2⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 604
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-2-0x0000000000000000-mapping.dmp

Download
memory/1808-4-0x0000000000000000-mapping.dmp

Download
memory/3268-3-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download