b4095d1c356a145cca001102abd0ad719a1798594756d20e198f92a39ba21af7 | Triage

Resubmissions

13-09-2021 16:54

210913-vemrdshbgr 10

13-09-2021 16:37

210913-t4s42aeba5 10

Analysis

max time kernel
311s
max time network
1727s
platform
windows10_x64
resource
win10v20210408
submitted
13-09-2021 16:54

Sharing

Report Analysis Logs

General

Target

triage_dropped_file.dll
Size

542KB
MD5

a72b41be79e3fba13890f3487e6e794b
SHA1

180ec439b27f512428550d3a199edcd013754602
SHA256

b4095d1c356a145cca001102abd0ad719a1798594756d20e198f92a39ba21af7
SHA512

4c21d93e14aea94afca3378b6adbddad2c0ddc579d1bf81e437da2b42d1228992ffe61532a3055af9e794144c3ff0f8f31aff9c9e297a0dba41d649af614a3d6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3548 500 WerFault.exe regsvr32.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3548 WerFault.exe
Token: SeBackupPrivilege 3548 WerFault.exe
Token: SeDebugPrivilege 3548 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3128 wrote to memory of 500	3128	regsvr32.exe	regsvr32.exe
PID 3128 wrote to memory of 500	3128	regsvr32.exe	regsvr32.exe
PID 3128 wrote to memory of 500	3128	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
2⤵
PID:500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 500 -s 616
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-114-0x0000000000000000-mapping.dmp

Download
memory/500-115-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/500-118-0x0000000000870000-0x00000000008A8000-memory.dmp

Filesize
224KB

Download
memory/500-120-0x0000000000AA0000-0x0000000000AE5000-memory.dmp

Filesize
276KB

Download