e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03 | Triage™

Analysis

max time kernel
120s
max time network
161s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03.exe
Size 176KB
Sample220124-a6vk4aghhj
SHA256 e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03
MD5 390616521c4a8fad53c5524ce1d637c0
SHA1 d8f29633c4843d09361f5d7135c73664aa83f13b
SHA512 6afe9e4d98aa9bd4addaeac33476a2f8b82d37b58fc1a9a1db1b3e4439671df0cf75632a1752c45b7ac061a356425cfce3b86c8459b1708c48471d581fb4b7e0
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3092	3052	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3092	WerFault.exe
Token: SeBackupPrivilege	3092	WerFault.exe
Token: SeDebugPrivilege	3092	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03.exe
"C:\Users\Admin\AppData\Local\Temp\e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03.exe"
1⤵
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 236
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads