7bd8097de078f21e7f97dc04fac6ed6a4d7bc042934e2ec179706838303efe2f | Triage™

Analysis

max time kernel
85s
max time network
88s
platform
windows10_x64
resource
win10v20210408
submitted
26/09/2021, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cejetjwve.txt.jar
Size 92KB
Sample210926-twypjsfbd4
SHA256 7bd8097de078f21e7f97dc04fac6ed6a4d7bc042934e2ec179706838303efe2f
MD5 9f529d816bffd28587755104a62e7ffe
SHA1 2ced260d71011c450dab5145881fad5460d00edb
SHA512 ccb1437c4fc7465bfdd62e5a7556a13f2bbebafe73e6c545a0125fe0289e833928b6c9f61ce36102ea107a6054f6ac738fae81ac068555fc500f1df15ac6baab
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3972	532	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe
3972	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	WerFault.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\cejetjwve.txt.jar
1⤵
PID:532
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 532 -s 376
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads