8b8524d99c41e32912669ff4be7aba713495ad3fc03e345c5a7e16d473718e48 | Triage

Analysis

max time kernel
321s
max time network
1738s
platform
windows10_x64
resource
win10v20210410
submitted
06-08-2021 11:49

Sharing

Report Analysis Logs

General

Target

Raccine/Raccine.exe
Size

382KB
MD5

287f6cfbffd83b75a0f8f749b0f636f3
SHA1

5769f38bf61cab67a410ebf5e615ab008bf74a88
SHA256

e5364ce4bd1814e003215bff10dd2f191c33199260dfd2688d4f6cce4a7c75b8
SHA512

02380b27e955ed74cc4bbdc112b3bb91e0c049baa567b362ca5db2d2e1e9f988ebac60bc00619a5201f56eea39cae31071445906426723daa47f0bb294f7bc09

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3604 created 2256 3604 WerFault.exe Raccine.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3604 2256 WerFault.exe Raccine.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

Raccine.exeWerFault.exe

pid	process
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
2256	Raccine.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe
3604	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3604 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Raccine\Raccine.exe
"C:\Users\Admin\AppData\Local\Temp\Raccine\Raccine.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2256 -s 516
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...