bbfe83183f442811f46283964fccdab46a9824e54732b309116fcacfab03ba62 | Triage

Analysis

max time kernel
129s
max time network
131s
platform
windows10_x64
resource
win10v20210410
submitted
13-05-2021 12:54

Sharing

Report Analysis Logs

General

Target

bbfe83183f442811f46283964fccdab46a9824e54732b309116fcacfab03ba62.exe
Size

91KB
MD5

c24430de899e686c6cd48d79c130ba17
SHA1

ff2ed5496f574c97c5526bd98a62afb78f961ed7
SHA256

bbfe83183f442811f46283964fccdab46a9824e54732b309116fcacfab03ba62
SHA512

cf47607e0a79cca36d0a4c6c7def1ad5d0d208678dc94589f1bfa5970dffd15ece7c60a868153d47e7fe267c1840534452a5cb77be222965daa95fc506b43736

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1172 4048 WerFault.exe bbfe83183f442811f46283964fccdab46a9824e54732b309116fcacfab03ba62.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe
1172	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1172 WerFault.exe
Token: SeBackupPrivilege 1172 WerFault.exe
Token: SeDebugPrivilege 1172 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bbfe83183f442811f46283964fccdab46a9824e54732b309116fcacfab03ba62.exe
"C:\Users\Admin\AppData\Local\Temp\bbfe83183f442811f46283964fccdab46a9824e54732b309116fcacfab03ba62.exe"
1⤵
PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 512
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads