c50fdedeb99bd961d5a358311df95cd862025c196e7ca0c7f8baf5e05ece5819 | Triage

Analysis

max time kernel
119s
max time network
149s
platform
windows10_x64
resource
win10-en-20211104
submitted
18-11-2021 13:10

Sharing

Report Analysis Logs

General

Target

400000.RegSvcs.exe
Size

459KB
MD5

3d9c6effc5e8e312f9e9109b7e2caf40
SHA1

d26e1fa6c5fc61d900b178a3de65ba0e547837f1
SHA256

c50fdedeb99bd961d5a358311df95cd862025c196e7ca0c7f8baf5e05ece5819
SHA512

cb0a4d3ff70b5194fe820d068f01f0ea6264ef578234f8a07abac114d83e16d6c5fc00e94071f546d8df03586ca1784e4c9700bb4f9c762c1d80560423185fc2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3980 3684 WerFault.exe 400000.RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe
3980	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3980 WerFault.exe
Token: SeBackupPrivilege 3980 WerFault.exe
Token: SeDebugPrivilege 3980 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\400000.RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\400000.RegSvcs.exe"
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 564
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...