7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748 | Triage

Resubmissions

06-07-2021 11:29

210706-mvrlwxcm6n 10

30-06-2021 05:42

210630-grn7wr8e66 10

25-06-2021 09:46

210625-gw37l4txax 10

Analysis

max time kernel
16s
max time network
116s
platform
windows10_x64
resource
win10v20210408
submitted
25-06-2021 09:46

Sharing

Report Analysis Logs

General

Target

7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe
Size

122KB
MD5

2354add5a5f76c25feb03b8d0ed573b1
SHA1

b157ac4a24515f30648853a9e97c81a7b62240f9
SHA256

7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748
SHA512

5663fa484af8c33c2cd5af8fe7694a5b98d9abf2f233a35775401424a0b256bb02b24804de9d316d5bb739b7e2080fe1c5c143805a58b2e185eb88f33bafbbcf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3664 856 WerFault.exe 7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe
3664	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3664 WerFault.exe
Token: SeBackupPrivilege 3664 WerFault.exe
Token: SeDebugPrivilege 3664 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe"
1⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 344
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...