f865736f27acaaca93c530f82295fdddf9b97fc54f37732815e89ad660eb69e4 | Triage

Resubmissions

27-01-2021 13:48

210127-r2lv7jddhs 10

27-01-2021 01:17

210127-7n6zga3sne 10

Analysis

max time kernel
16s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
27-01-2021 13:48

Sharing

Report Analysis Logs

General

Target

2760000.netprovfw.bin.exe
Size

342KB
MD5

90478bb3273d74a7a4bae530dee87174
SHA1

8fa8f069d4391a21346de65a5ee729ad6ef56a60
SHA256

f865736f27acaaca93c530f82295fdddf9b97fc54f37732815e89ad660eb69e4
SHA512

4df47075f24abd5882f27e22d39c6a73b1586ddd1757539387a885e3f112e1e00b4b97b4f68d91ef5662c7a3973ab350fe5e1e68d36943948ffa255315f51961

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2712 3084 WerFault.exe 2760000.netprovfw.bin.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2712 WerFault.exe
Token: SeBackupPrivilege 2712 WerFault.exe
Token: SeDebugPrivilege 2712 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2760000.netprovfw.bin.exe
"C:\Users\Admin\AppData\Local\Temp\2760000.netprovfw.bin.exe"
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 612
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-2-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/2712-3-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download