e818aee30503e8700185624059b89ebf7daccd482964a073f1ffdcbd5482b025 | Triage™

Analysis

max time kernel
86s
max time network
121s
platform
windows10_x64
resource
win10-en-20211208
submitted
13/01/2022, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e818aee30503e8700185624059b89ebf7daccd482964a.exe
Size 441KB
Sample220113-2c5yhsdabk
SHA256 e818aee30503e8700185624059b89ebf7daccd482964a073f1ffdcbd5482b025
MD5 25c152d0f7f59d82854da128a1920795
SHA1 f443e0e795a5612d197a7d1fbd75c60c6493c1e6
SHA512 42f79ee03d1f50c6be98762794e9e777d8878a35f006e3dc081d918d97e73662a225b71fc19691c01bd3b76fa27054a2ac5e7c5ff1b0757d3ca65303e0333660
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	672	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe
1200	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1200	WerFault.exe
Token: SeBackupPrivilege	1200	WerFault.exe
Token: SeDebugPrivilege	1200	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e818aee30503e8700185624059b89ebf7daccd482964a.exe
"C:\Users\Admin\AppData\Local\Temp\e818aee30503e8700185624059b89ebf7daccd482964a.exe"
1⤵
PID:672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 400
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-118-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download