Analysis
- max time kernel
150s - max time network
121s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
9ae5b3d8924d251ed4799a1223da2aac.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 9ae5b3d8924d251ed4799a1223da2aac.exe
- Size 514KB
- Sample201117-5txfswcgl6
- SHA256 86c1ba04c2400da557124c31d3366eb792080a254e6166e7a426a27b0cd16693
- MD5 f419548a046f3238df9d95d40e3a8fdd
- SHA1 76fda035703781cfe5f785b8f230e7db6eef2abf
- SHA512 cca8b94d53abde68c7fcf83fa246674cea3c607e65164d59824ec940b720560c33574c1e2e40c811667f9c685d61017eb27ca03bf671a159c4d8066ccf12f36d
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4064 created 648 4064 WerFault.exe 67 - Program crash 7 IoCs
pid pid_target Process procid_target 2680 648 WerFault.exe 67 1436 648 WerFault.exe 67 1976 648 WerFault.exe 67 4088 648 WerFault.exe 67 992 648 WerFault.exe 67 1924 648 WerFault.exe 67 4064 648 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 98 IoCs
pid Process 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1436 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 1924 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe 4064 WerFault.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 2680 WerFault.exe Token: SeBackupPrivilege 2680 WerFault.exe Token: SeDebugPrivilege 2680 WerFault.exe Token: SeDebugPrivilege 1436 WerFault.exe Token: SeDebugPrivilege 1976 WerFault.exe Token: SeDebugPrivilege 4088 WerFault.exe Token: SeDebugPrivilege 992 WerFault.exe Token: SeDebugPrivilege 1924 WerFault.exe Token: SeDebugPrivilege 4064 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ae5b3d8924d251ed4799a1223da2aac.exe"C:\Users\Admin\AppData\Local\Temp\9ae5b3d8924d251ed4799a1223da2aac.exe"1⤵PID:648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 8162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 9082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 11922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 11442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 6442⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4064
-