07aa7e390ecd5d9295b75f8ed032d17e87f91ae8bc05cd6e5e94df2d34d672df | Triage™

Analysis

max time kernel
117s
max time network
123s
platform
windows10_x64
resource
win10-en-20211014
submitted
06/12/2021, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07aa7e390ecd5d9295b75f8ed032d17e87f91ae8bc05c.exe
Size 451KB
Sample211206-ylek5shhg2
SHA256 07aa7e390ecd5d9295b75f8ed032d17e87f91ae8bc05cd6e5e94df2d34d672df
MD5 358319a844f5932e60facd3d5c03e788
SHA1 b0f1f41974672cf08b6abb5caf765bd74cfb9694
SHA512 bda9096a49bf090e589bd7cd085d748fc29a6bb5071948d462fb55d8cab33d021732c9a3c26a35be56586c98df9869959f294fd672c47922d42c42d3a8711279
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1848	2780	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1848	WerFault.exe
Token: SeBackupPrivilege	1848	WerFault.exe
Token: SeDebugPrivilege	1848	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\07aa7e390ecd5d9295b75f8ed032d17e87f91ae8bc05c.exe
"C:\Users\Admin\AppData\Local\Temp\07aa7e390ecd5d9295b75f8ed032d17e87f91ae8bc05c.exe"
1⤵
PID:2780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 244
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads