218a43f5f1a1bb3a7974fe8fd0532829b1b858dec3c8d6bc2a5835a6bb735321 | Triage

Analysis

max time kernel
68s
max time network
71s
platform
windows10_x64
resource
win10v20210408
submitted
30-09-2021 11:02

Sharing

Report Analysis Logs

General

Target

New order and image.exe
Size

326KB
MD5

d7dd8868b5318b516d22930a624d096d
SHA1

4a01fcbced1e4234bfd10ea8980b6c65684f3b28
SHA256

218a43f5f1a1bb3a7974fe8fd0532829b1b858dec3c8d6bc2a5835a6bb735321
SHA512

1f93982b39ff3142c7248bfd5c4ffe3d05ecb4d8a0f0a89edd0f22d96bb9d2eaa1af6420623458cafd29a50d6388f829a9e931cd93bc8a594464aa0ac5071ff8

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 836 created 628 836 WerFault.exe New order and image.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 628 WerFault.exe New order and image.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe
836	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 836 WerFault.exe
Token: SeBackupPrivilege 836 WerFault.exe
Token: SeDebugPrivilege 836 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\New order and image.exe
"C:\Users\Admin\AppData\Local\Temp\New order and image.exe"
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 244
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:836

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-114-0x0000000000890000-0x00000000009DA000-memory.dmp

Filesize
1.3MB

Download