3ecc6468de96ac9ae350154c117610dd3062f968be547d6b67b3f126fee512e9 | Triage

Analysis

max time kernel
113s
max time network
119s
platform
windows10_x64
resource
win10v20210408
submitted
28-09-2021 07:04

Sharing

Report Analysis Logs

General

Target

NRB-RTGS 28-Sept 2021.jar
Size

103KB
MD5

ccfdd7c24c9029f301ee94dbc9441ace
SHA1

99dce2074fd2cca2ede69a3b08cf33a574a4a976
SHA256

3ecc6468de96ac9ae350154c117610dd3062f968be547d6b67b3f126fee512e9
SHA512

3ca8410aca55b1acb92e1c5316fffb01815b7b69b850c1637cc4b04f43a83f2cf52c21c0785c4af30ce9655782c1d285d82055bb120e41d103f0758bf37fe258

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

492 776 WerFault.exe java.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe
492	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 492 WerFault.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\NRB-RTGS 28-Sept 2021.jar"
1⤵
PID:776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 776 -s 372
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...