ef11f3bb330534ff0c336db96f6e064381bfe213ed20764e75593ef4f3104ffd | Triage

Analysis

max time kernel
160s
max time network
167s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:44

Sharing

Report Analysis Logs

General

Target

ef11f3bb330534ff0c336db96f6e064381bfe213ed20764e75593ef4f3104ffd.exe
Size

164KB
MD5

448cddc1dc104a3f3e5262790e913fb2
SHA1

2e96108bb045d9d8f660bcb3612fc1031679e883
SHA256

ef11f3bb330534ff0c336db96f6e064381bfe213ed20764e75593ef4f3104ffd
SHA512

75e0f330a918fd71d97f9e33a112bd02a3ab8bcc0f6fb17a13a03be01916161d4d0bd7c837f69ca827fb35ce196e2fc3b2372c557a01389b676bd81d54182790

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 2652 WerFault.exe ef11f3bb330534ff0c336db96f6e064381bfe213ed20764e75593ef4f3104ffd.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe
1120	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1120 WerFault.exe
Token: SeBackupPrivilege 1120 WerFault.exe
Token: SeDebugPrivilege 1120 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ef11f3bb330534ff0c336db96f6e064381bfe213ed20764e75593ef4f3104ffd.exe
"C:\Users\Admin\AppData\Local\Temp\ef11f3bb330534ff0c336db96f6e064381bfe213ed20764e75593ef4f3104ffd.exe"
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 568
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...