Behavioral Report

Resubmissions

19-01-2021 19:24

19-11-2020 13:14

Score

3^/10

Program crash ⋅ 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3220 4724 WerFault.exe WSHSetup[1].exe
NTFS ADS ⋅ 1 IoCs

Processes:

WSHSetup[1].exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\򀂖C:\Windows\SysWOW64 WSHSetup[1].exe

pid	pid_target	process	target process
3220	4724	WerFault.exe	WSHSetup[1].exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\򀂖C:\Windows\SysWOW64	WSHSetup[1].exe

Suspicious behavior: EnumeratesProcesses ⋅ 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3220 WerFault.exe
Token: SeBackupPrivilege 3220 WerFault.exe
Token: SeDebugPrivilege 3220 WerFault.exe

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00