Analysis
- max time kernel
17s - max time network
75s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/07/2021, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
D7D4E4B2AB07D6704484D09D231B0336.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
D7D4E4B2AB07D6704484D09D231B0336.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target D7D4E4B2AB07D6704484D09D231B0336.exe
- Size 252KB
- Sample210708-kn3zs2hfss
- SHA256 7525f2c1ccec025adb8f773ab10ecd9cee7bacec9949a7415ad239cec969bfb8
- MD5 d7d4e4b2ab07d6704484d09d231b0336
- SHA1 722f725afe6f13661155387c3a04ba0388404448
- SHA512 7dca89be424cc98b083e3bc9a651a0662cbfefdc2169863838e7c077da196012794647f4a7e19971101b85bfa0384356017adb2a7015fd41f4df3f214abbca45
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 908 created 860 908 WerFault.exe 67 - Downloads MZ/PE file
- Program crash 8 IoCs
pid pid_target Process procid_target 3000 860 WerFault.exe 67 212 860 WerFault.exe 67 2312 860 WerFault.exe 67 2060 860 WerFault.exe 67 4080 860 WerFault.exe 67 1120 860 WerFault.exe 67 2160 860 WerFault.exe 67 908 860 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 3000 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2312 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeRestorePrivilege 3000 WerFault.exe Token: SeBackupPrivilege 3000 WerFault.exe Token: SeDebugPrivilege 3000 WerFault.exe Token: SeDebugPrivilege 212 WerFault.exe Token: SeDebugPrivilege 2312 WerFault.exe Token: SeDebugPrivilege 2060 WerFault.exe Token: SeDebugPrivilege 4080 WerFault.exe Token: SeDebugPrivilege 1120 WerFault.exe Token: SeDebugPrivilege 2160 WerFault.exe Token: SeDebugPrivilege 908 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D7D4E4B2AB07D6704484D09D231B0336.exe"C:\Users\Admin\AppData\Local\Temp\D7D4E4B2AB07D6704484D09D231B0336.exe"1⤵PID:860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 6602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 7442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 7962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 13082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 13202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 12962⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:908
-