ae33e9f2e18d4fdd25db5bc30b8b8bdd63b53794e225dbe818ebe65a29b0dc95 | Triage™

Analysis

max time kernel
27s
max time network
137s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orderlistxlsx.jar
Size 129KB
Sample210830-fl8dly9cye
SHA256 ae33e9f2e18d4fdd25db5bc30b8b8bdd63b53794e225dbe818ebe65a29b0dc95
MD5 d82b9d7af67f2ade0c11bfe6bfd69544
SHA1 051c9770aebcc850ae09baa6a223848a7aa3f289
SHA512 fbfc1943e95be1d5c9a536e2aa9267b188eb81e9c9445074c2b69d01f7d092c0d1590e15c8579da0c6ab1ba97e1767cd5a2984a1eb6e08611df3fec5764dc555
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3996	992	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe
3996	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3996	WerFault.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Orderlistxlsx.jar
1⤵
PID:992
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 992 -s 372
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads