f98554ec12ff9b31690509833d8c1a016d5c00f3fbafd9294928a581dadb65ed | Triage

Analysis

max time kernel
122s
max time network
137s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:41

Sharing

Report Analysis Logs

General

Target

f98554ec12ff9b31690509833d8c1a016d5c00f3fbafd9294928a581dadb65ed.exe
Size

164KB
MD5

88de91c74c60960ac02bab6d3b6c11db
SHA1

711bbcd91f1de003e8523ee51d66340d73059806
SHA256

f98554ec12ff9b31690509833d8c1a016d5c00f3fbafd9294928a581dadb65ed
SHA512

58c5c65fe3aed6aa0ba064c62d5ac3ba65485b27dece68e2301dbb077d75ea3f5ec6404b639843718037ae9b55dfb549ba487ddc0f7c9967651c8cdc655d0f06

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2880 2428 WerFault.exe f98554ec12ff9b31690509833d8c1a016d5c00f3fbafd9294928a581dadb65ed.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2880 WerFault.exe
Token: SeBackupPrivilege 2880 WerFault.exe
Token: SeDebugPrivilege 2880 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f98554ec12ff9b31690509833d8c1a016d5c00f3fbafd9294928a581dadb65ed.exe
"C:\Users\Admin\AppData\Local\Temp\f98554ec12ff9b31690509833d8c1a016d5c00f3fbafd9294928a581dadb65ed.exe"
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 564
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...