1e6d253a7e98aecc71ea7509f5fcfaef4c91258403dcb028cfa6e0e7d47d8080 | Triage™

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
28/09/2021, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.GenericKD.47018895.14341.31913.exe
Size 4.2MB
Sample210928-rezt6scba7
SHA256 1e6d253a7e98aecc71ea7509f5fcfaef4c91258403dcb028cfa6e0e7d47d8080
MD5 ea5c4a912a9454bec895a614a8c442eb
SHA1 76e9faa287c5f9905c7b4c4e8e5c8ce943dc6118
SHA512 141f1f184d3fff6ee18982d0eb964f581f3f51940e0874e864c118108db92bf4e6eaec55d3655aa384a56ac683bfac4e8653c3f0b5b5807829f363a420d0873c
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	2160	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2620	WerFault.exe
Token: SeBackupPrivilege	2620	WerFault.exe
Token: SeDebugPrivilege	2620	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.47018895.14341.31913.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.47018895.14341.31913.exe"
1⤵
PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 504
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-115-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Download