96ed2610e94b19233c22c2341bb36f340298d76bb36bf658a0d853b91e1acc4e | Triage™

Analysis

max time kernel
78s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tradecheat.exe
Size 3.5MB
Sample220124-2stkesbgar
SHA256 96ed2610e94b19233c22c2341bb36f340298d76bb36bf658a0d853b91e1acc4e
MD5 73287415802ef1f46dc8ab0e42bd19e6
SHA1 54fb4824c22f94acdb4f1c412af6602e97990f86
SHA512 d798c980fbf37a25bbf036d697342a21b28dd334af2ab340d203742c3b6e0ba29c2030e07116411854e099e7311e58c018621c96e8cea58014f5e4f4634f859f
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2620	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2576	WerFault.exe
Token: SeBackupPrivilege	2576	WerFault.exe
Token: SeDebugPrivilege	2576	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tradecheat.exe
"C:\Users\Admin\AppData\Local\Temp\tradecheat.exe"
1⤵
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-115-0x0000000002760000-0x00000000027C0000-memory.dmp

Download