ce929249852f9a96697970c7a912e7e90d9c9d375766e8346407d5ee799b8535 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows10_x64
resource
win10v20210410
submitted
13-05-2021 12:55

Sharing

Report Analysis Logs

General

Target

ce929249852f9a96697970c7a912e7e90d9c9d375766e8346407d5ee799b8535.exe
Size

78KB
MD5

ba13c697ac23b83306f2642cfeeb821f
SHA1

443417f2559ed0942fbe74a056eca9e466d22669
SHA256

ce929249852f9a96697970c7a912e7e90d9c9d375766e8346407d5ee799b8535
SHA512

0f73c0dc3272c17c1981f8146f2fe0a515fcf43763f56368b1d983ed34d881044f87eae073e7d4bfc307414c6370bbbde5f40949dd58a84e3315c4b86aecdb9f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4868 4436 WerFault.exe ce929249852f9a96697970c7a912e7e90d9c9d375766e8346407d5ee799b8535.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe
4868	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4868 WerFault.exe
Token: SeBackupPrivilege 4868 WerFault.exe
Token: SeDebugPrivilege 4868 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ce929249852f9a96697970c7a912e7e90d9c9d375766e8346407d5ee799b8535.exe
"C:\Users\Admin\AppData\Local\Temp\ce929249852f9a96697970c7a912e7e90d9c9d375766e8346407d5ee799b8535.exe"
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 376
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...