bd8cdc89f3b3341a93594953b1bd7611a18c23d90ba64271ac914ae363959198 | Triage

Analysis

max time kernel
116s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
21-09-2021 13:40

Sharing

Report Analysis Logs

General

Target

adobe1_04360000.bin.exe
Size

524KB
MD5

c0429d00ac38321a0514d621895117cd
SHA1

c493d98f86699cb91363e7a1c267762ba341a247
SHA256

bd8cdc89f3b3341a93594953b1bd7611a18c23d90ba64271ac914ae363959198
SHA512

645d6864ed7313e1b00923715556aa8b7e68deee1c389d9b8abb39fedb250aca9c9c661d534dd23d8c11cc68df7405f5f193c87fc6069dfa1d60f08657f43529

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3684 2640 WerFault.exe adobe1_04360000.bin.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3684 WerFault.exe
Token: SeBackupPrivilege 3684 WerFault.exe
Token: SeDebugPrivilege 3684 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\adobe1_04360000.bin.exe
"C:\Users\Admin\AppData\Local\Temp\adobe1_04360000.bin.exe"
1⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 576
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...