83a2b8f097269bd8fb5a70725a3cbfee5308300b197368308e3a5adba849111d | Triage

Analysis

max time kernel
323s
max time network
1738s
platform
windows10_x64
resource
win10v20210408
submitted
22-07-2021 02:20

Sharing

Report Analysis Logs

General

Target

sds.hta
Size

2KB
MD5

f8f46135633afaa03568145c8d1316c4
SHA1

199c13fc844d44188a8883324c176ce422a97ca6
SHA256

83a2b8f097269bd8fb5a70725a3cbfee5308300b197368308e3a5adba849111d
SHA512

ee55ca0e35efaa1e5d6168cc0ce9f6d0315eb209eb1733c905cbe7fe98cd8511fa7f00e5155b0960b97c750c580104a11bc3fefc4bd31cfa049710aa604c13d5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4028 4060 WerFault.exe mshta.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4028 WerFault.exe
Token: SeBackupPrivilege 4028 WerFault.exe
Token: SeDebugPrivilege 4028 WerFault.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\sds.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1320
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...