f82cf144897df123e0aba125c2b5ee165f8f4542ee19d6dfba05aa3bc18c4276 | Triage

Analysis

max time kernel
120s
max time network
150s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:42

Sharing

Report Analysis Logs

General

Target

f82cf144897df123e0aba125c2b5ee165f8f4542ee19d6dfba05aa3bc18c4276.exe
Size

160KB
MD5

7d73d81d6b638b21486d4f256cdc2dc7
SHA1

225c048d8ed1b309db1334e74b2cfb816074a91e
SHA256

f82cf144897df123e0aba125c2b5ee165f8f4542ee19d6dfba05aa3bc18c4276
SHA512

5720d3005c2ab25102bc436d203ea3504c8daa5b007d14038b06d4f6be26308f63d237d8d5708943828e08d420355d944f3816fbbfd23dbd6687b76dd810507c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3776 2408 WerFault.exe f82cf144897df123e0aba125c2b5ee165f8f4542ee19d6dfba05aa3bc18c4276.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3776 WerFault.exe
Token: SeBackupPrivilege 3776 WerFault.exe
Token: SeDebugPrivilege 3776 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f82cf144897df123e0aba125c2b5ee165f8f4542ee19d6dfba05aa3bc18c4276.exe
"C:\Users\Admin\AppData\Local\Temp\f82cf144897df123e0aba125c2b5ee165f8f4542ee19d6dfba05aa3bc18c4276.exe"
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 232
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...