ab08cb1279ca9edb9f2c8ca26e4785ad7db6aefaea3e952f20b50387fad0b9b1 | Triage™

Analysis

max time kernel
116s
max time network
121s
platform
windows10_x64
resource
win10-en-20210920
submitted
02/10/2021, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe
Size 907KB
Sample211002-hs8jssdhd8
SHA256 ab08cb1279ca9edb9f2c8ca26e4785ad7db6aefaea3e952f20b50387fad0b9b1
MD5 4ea1be50c91ccd1dbadb711fc6a66e86
SHA1 7c57c02e4cf47b0d3449aada841ffc5f127bd41d
SHA512 2c8eb373a2fedea68f3bc9078a26102064309961f02d1d117dc26402b177a545dab941a405ec19dfe71748953c7effbf56a888c81a19ce9c9a094447272c0db4
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3160	2332	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3160	WerFault.exe
Token: SeBackupPrivilege	3160	WerFault.exe
Token: SeDebugPrivilege	3160	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe
"C:\Users\Admin\AppData\Local\Temp\AĞUSTOS AYI PERSONEL BAZLI PRİM KAZANÇ TABLOSU.exe"
1⤵
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 1080
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-115-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download