a66b0a7715d2709fb4a4dfd3dec6cbc138b9df426c91e78072d0d55941596836 | Triage

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-en
submitted
13-09-2021 10:49

Sharing

Report Analysis Logs

General

Target

download.jar
Size

371KB
MD5

d26fa3f52015a2cd0b50fc8468a00ac0
SHA1

410f4996e614ccaac430b042afc828e5bbe63589
SHA256

a66b0a7715d2709fb4a4dfd3dec6cbc138b9df426c91e78072d0d55941596836
SHA512

4199ac8470f2fb1f9a2a4eb7524bd33ff08ca3cd3a259a71d2923c4193044b5f27f54922f446248f862e1ebb4ceb4cb3d4f054ed61d23c5f56d0abc89431385d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1080 WerFault.exe java.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1756 WerFault.exe
1756 WerFault.exe
1756 WerFault.exe
1756 WerFault.exe
1756 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1756 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

java.exe

description	pid	process	target process
PID 1080 wrote to memory of 1756	1080	java.exe	WerFault.exe
PID 1080 wrote to memory of 1756	1080	java.exe	WerFault.exe
PID 1080 wrote to memory of 1756	1080	java.exe	WerFault.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\download.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1080 -s 148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-53-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Filesize
8KB

Download
memory/1756-54-0x0000000000000000-mapping.dmp

Download
memory/1756-56-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download