2f868c03fe2bec5e9699b2fe3e03359181162eaf8373404bbd9df766ada1bdb2 | Triage

Analysis

max time kernel
30s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
13-05-2021 12:58

Sharing

Report Analysis Logs

General

Target

2f868c03fe2bec5e9699b2fe3e03359181162eaf8373404bbd9df766ada1bdb2.exe
Size

3.4MB
MD5

616733a49511bbf2ede84fe81fb984c8
SHA1

fde08d137b8e34733fedc0a8e9697702bf9d9745
SHA256

2f868c03fe2bec5e9699b2fe3e03359181162eaf8373404bbd9df766ada1bdb2
SHA512

b4857eabe66852d3c927208d8f2f234b212904c76b8874f129214dad46fe014f2488fda336773beb549023f1cb038e8f4daf80616bd1457512fb03f1941ff377

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2664 644 WerFault.exe 2f868c03fe2bec5e9699b2fe3e03359181162eaf8373404bbd9df766ada1bdb2.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2664 WerFault.exe
Token: SeBackupPrivilege 2664 WerFault.exe
Token: SeDebugPrivilege 2664 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2f868c03fe2bec5e9699b2fe3e03359181162eaf8373404bbd9df766ada1bdb2.exe
"C:\Users\Admin\AppData\Local\Temp\2f868c03fe2bec5e9699b2fe3e03359181162eaf8373404bbd9df766ada1bdb2.exe"
1⤵
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 720
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...