ed3331b6bb3e0e76b387c9427bde9adc6fee9d147dcf924161ec2893bc31df69 | Triage™

Analysis

max time kernel
89s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
02/10/2021, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL_119040 رسید دستاویز,pdf.exe
Size 893KB
Sample211002-htsjzaeadp
SHA256 ed3331b6bb3e0e76b387c9427bde9adc6fee9d147dcf924161ec2893bc31df69
MD5 80f1b92f3bc45e072db4715a23101852
SHA1 4733fbcca5e5d3ab08fd208b57239226fdaf5a29
SHA512 0a5a740addca698146282ac2f683d8ea0fabc5496f646acadd4ba46e6996f553f2e631fee9caeaf1c73025fce093e6e263010c67aeaf3129e67b9cf78aae60f8
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4728	4648	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4728	WerFault.exe
Token: SeBackupPrivilege	4728	WerFault.exe
Token: SeDebugPrivilege	4728	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL_119040 رسید دستاویز,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_119040 رسید دستاویز,pdf.exe"
1⤵
PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1092
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4648-114-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download