920d80efcbeee1a05139ffbea05ca56e59e71809d11afbe47d1e2e9aa95a0e5b | Triage™

Analysis

max time kernel
18s
max time network
114s
platform
windows10_x64
resource
win10v20210408
submitted
26/08/2021, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation.jar
Size 106KB
Sample210826-pyvmn8ldas
SHA256 920d80efcbeee1a05139ffbea05ca56e59e71809d11afbe47d1e2e9aa95a0e5b
MD5 79d2b79bad5f52b3bd2e82327f871c92
SHA1 b0f67fa71525e2f843e73e84661ee638b0463f30
SHA512 5b335834449a94a6565bc5f26e50d248b3cf59ad7e31465e5522ebaf80d39ed9816e1f86c47e85a608ae16968b6f3636c1b521a822afef24f53826b17c3fcd75
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3588	900	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	WerFault.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Quotation.jar
1⤵
PID:900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 900 -s 376
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads