20351665df8b2d441524a21163e0aa95ea3d3805a873032eb6f55fa1001f3941 | Triage

Analysis

max time kernel
100s
max time network
102s
platform
windows10_x64
resource
win10v20210408
submitted
28-09-2021 10:47

Sharing

Report Analysis Logs

General

Target

Quotation.jar
Size

184KB
MD5

8eab8f1a928fa55303b7558536079a2a
SHA1

491e913225a8c8d144c538fe27cf62f5a8465b38
SHA256

20351665df8b2d441524a21163e0aa95ea3d3805a873032eb6f55fa1001f3941
SHA512

886928d68f14c012186872429739d1317350f329e5afa4ec820779e7f312d776433e8926000f522a3393e2ad454779eee1245ba266226bd0c8421f1fb97ba4a0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1160 804 WerFault.exe java.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1160 WerFault.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Quotation.jar
1⤵
PID:804

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 804 -s 376
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...