ca7072bba9d1b75b02b5d2887fdb7bcb1f86050b669ffd99a7e756e1a60095f2 | Triage™

Analysis

max time kernel
109s
max time network
111s
platform
windows10_x64
resource
win10v20210408
submitted
18/09/2021, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice.jar
Size 98KB
Sample210918-n32f5ahcf4
SHA256 ca7072bba9d1b75b02b5d2887fdb7bcb1f86050b669ffd99a7e756e1a60095f2
MD5 db9cc0db01ec3ab20a2693d957f495b8
SHA1 5136271deac72742c6c95148db042f3e15d8101d
SHA512 66f1e462ce9aed7e9ca37437964057dc9f9d3c37a2e9e8f0921888420ebf5e7335fa9947a264888981c04ddefcb88a702016879a355ff4fa016b2e0124197237
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3988	652	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe
3988	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	WerFault.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\invoice.jar
1⤵
PID:652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 652 -s 372
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads