Resubmissions
10-06-2021 05:24
210610-y3fehajl3e 1003-06-2021 06:13
210603-588v9l62k2 1001-06-2021 06:25
210601-24dkm2kegn 10Analysis
-
max time kernel
64s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-06-2021 06:13
Static task
static1
Behavioral task
behavioral1
Sample
77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe
Resource
win10v20210410
General
-
Target
77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe
-
Size
132KB
-
MD5
475044e6128273b86dc2b263daebb11c
-
SHA1
4e4f60db82c6b992520eb058202e8e88a7b5f7f3
-
SHA256
77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee
-
SHA512
9bcee9420a27ef558d33056aee0198c7679bed25b572a17e18454816b8f20844a8db05afde8c8869809d34adc63f1ae1c27e12f6b93d807113b3f4854d637de8
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 852 3540 WerFault.exe 77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 852 WerFault.exe Token: SeBackupPrivilege 852 WerFault.exe Token: SeDebugPrivilege 852 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe"1⤵PID:3540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 3442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852