f6a6b131f7f03643d24d2d363381d25c9664e002c44e529e538a825f4bff4b16 | Triage

Analysis

max time kernel
118s
max time network
155s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:42

Sharing

Report Analysis Logs

General

Target

f6a6b131f7f03643d24d2d363381d25c9664e002c44e529e538a825f4bff4b16.exe
Size

160KB
MD5

0375bae693ac84c35082291b1860bfd4
SHA1

b7ffbdf600dc80e30ebf384a843dfe57228eb8ac
SHA256

f6a6b131f7f03643d24d2d363381d25c9664e002c44e529e538a825f4bff4b16
SHA512

2a4bb8eb54412944a6d5e536f12558c9f654ca54a816d5bb767082ee88f04b09ab68b62ef0129e6030b1c9be1e80da4b4d5f62bac77f0bdca59a1efe721d2619

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1868 2736 WerFault.exe f6a6b131f7f03643d24d2d363381d25c9664e002c44e529e538a825f4bff4b16.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1868 WerFault.exe
Token: SeBackupPrivilege 1868 WerFault.exe
Token: SeDebugPrivilege 1868 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f6a6b131f7f03643d24d2d363381d25c9664e002c44e529e538a825f4bff4b16.exe
"C:\Users\Admin\AppData\Local\Temp\f6a6b131f7f03643d24d2d363381d25c9664e002c44e529e538a825f4bff4b16.exe"
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 236
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...