e3e190eebf45fad540c7b0c60ded96512988423a535239c1520360862f1eabea | Triage™

Analysis

max time kernel
119s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
29/09/2021, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VmZTcqSQEiInvb.jar
Size 119KB
Sample210929-lr8d7aede5
SHA256 e3e190eebf45fad540c7b0c60ded96512988423a535239c1520360862f1eabea
MD5 da32f3d108deb072f3d5ab2c6f89ad74
SHA1 7f5371ba442190b1f47815f73a1dbb90009b738d
SHA512 fc9c254150aeed2663fbcf465a3abea965776a81a1c31fec1e9c0ce235844ff88811a276c75a067d9c13c4de312eb55a431e4d1a0acfee93efb4342a672eaced
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2160	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	WerFault.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\VmZTcqSQEiInvb.jar
1⤵
PID:2160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2160 -s 372
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads