8b8524d99c41e32912669ff4be7aba713495ad3fc03e345c5a7e16d473718e48 | Triage

Analysis

max time kernel
321s
max time network
389s
platform
windows10_x64
resource
win10v20210408
submitted
06-08-2021 11:49

Sharing

Report Analysis Logs

General

Target

Raccine/Raccine_x86.exe
Size

324KB
MD5

6c8a8c4bc32e79840d50cb0a87c83b5e
SHA1

2f1eea6881a71cdef168675412b53c04dff01561
SHA256

aef89ecf82bea84200e94c7206386733a0bd82a8ae47a38fc5e2d14e0b601b48
SHA512

3277105f1711a3a62a55cc3d94f5be1e85b22644b3096ca91c5cae27f52fdf744ddbb0e65f2a8bd2bc70ec8737d58fde4753cd114bab5392b22feaec65f1cf32

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3656 created 3492 3656 WerFault.exe Raccine_x86.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3656 3492 WerFault.exe Raccine_x86.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

Raccine_x86.exeWerFault.exe

pid	process
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3492	Raccine_x86.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3656 WerFault.exe
Token: SeBackupPrivilege 3656 WerFault.exe
Token: SeDebugPrivilege 3656 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Raccine\Raccine_x86.exe
"C:\Users\Admin\AppData\Local\Temp\Raccine\Raccine_x86.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 596
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...