c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows10_x64
resource
win10v20210410
submitted
13-05-2021 12:57

Sharing

Report Analysis Logs

General

Target

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
Size

91KB
MD5

4bb8e8a39a8a8a591d7c653e70b4dcdc
SHA1

d14af0cc6cd83a2214d44d48483bd6e36fc2d76e
SHA256

c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1
SHA512

721880a30c972a1022b3953f4ddab6c308b1d64bc6f57f152de4497b754e7075b086d06dbf580f0d1f91805633022ef736ae0c10960e7a18433936a3f7bb5c5a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 2016 WerFault.exe c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1424 WerFault.exe
Token: SeBackupPrivilege 1424 WerFault.exe
Token: SeDebugPrivilege 1424 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe
"C:\Users\Admin\AppData\Local\Temp\c5ceed35f0c3924d52c5082844060a4fb03f6c1d5df5a41b1610edcfa9d8cbc1.exe"
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 520
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...