485f3f878a825c720b10dcecdde1774972ba5518b95fbc663e9508154c4bcd01 | Triage™

Analysis

max time kernel
13s
max time network
69s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ec4c7b0ea8e691c92b4e0a75c953496.exe
Size 870KB
Sample210331-bltwydpez6
SHA256 485f3f878a825c720b10dcecdde1774972ba5518b95fbc663e9508154c4bcd01
MD5 4ec4c7b0ea8e691c92b4e0a75c953496
SHA1 e7a527315caa64925c921eca2cbcee34a84fa3d1
SHA512 517ebda6845621ac7656bc34ebcec4ecabcdb38586a645f9fa154fa8a28ea503e879cb7fcd605a53cb8f668decef27da6c6df484743c217435e8b1ae723470c0
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
648	1204	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1204	4ec4c7b0ea8e691c92b4e0a75c953496.exe
1204	4ec4c7b0ea8e691c92b4e0a75c953496.exe
1204	4ec4c7b0ea8e691c92b4e0a75c953496.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	4ec4c7b0ea8e691c92b4e0a75c953496.exe
Token: SeRestorePrivilege	648	WerFault.exe
Token: SeBackupPrivilege	648	WerFault.exe
Token: SeDebugPrivilege	648	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4ec4c7b0ea8e691c92b4e0a75c953496.exe
"C:\Users\Admin\AppData\Local\Temp\4ec4c7b0ea8e691c92b4e0a75c953496.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 832
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-5-0x00000000044B0000-0x00000000044B1000-memory.dmp

Download

memory/1204-2-0x0000000073450000-0x0000000073B3E000-memory.dmp

Download

memory/1204-3-0x0000000000910000-0x0000000000911000-memory.dmp

Download