5e30c8fcb1ddd09e85853ce25cccd20036e47f3dcc49436012a67b42574187b7 | Triage

Analysis

max time kernel
146s
max time network
141s
platform
windows10_x64
resource
win10-en-20210920
submitted
28-09-2021 09:19

Sharing

Report Analysis Logs

General

Target

5e30c8fcb1ddd09e85853ce25cccd20036e47f3dcc49436012a67b42574187b7.bin.sample.exe
Size

194KB
MD5

2286384bd0aec92e81a0a3163a45447c
SHA1

350bc9d5342f1adf4cd6482b051e9afb78c0eb91
SHA256

5e30c8fcb1ddd09e85853ce25cccd20036e47f3dcc49436012a67b42574187b7
SHA512

5d1bf6121b48ffdc728a1ecb583a32e0401235dffe188cd6c7b351480db1e12d8a7f39c29acf8e17533740afefc955d0adb36e9019bda6b3e2d9b69b658c9a98

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2656 2160 WerFault.exe 5e30c8fcb1ddd09e85853ce25cccd20036e47f3dcc49436012a67b42574187b7.bin.sample.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe
2656	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2656 WerFault.exe
Token: SeBackupPrivilege 2656 WerFault.exe
Token: SeDebugPrivilege 2656 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5e30c8fcb1ddd09e85853ce25cccd20036e47f3dcc49436012a67b42574187b7.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\5e30c8fcb1ddd09e85853ce25cccd20036e47f3dcc49436012a67b42574187b7.bin.sample.exe"
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 372
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...