f9360028f0313e3bf8b595aa92ddef1b21bd12e4dc79c636a11aaed160ff9b4d | Triage™

Analysis

max time kernel
122s
max time network
135s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/01/2022, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
674ad8128d17418474a2b4615da81c935d4d7f9c.exe
Size 160KB
Sample220128-vxxpbahea2
SHA256 ae9600cb391f447933e29069ca3000bb61a005d58fe14eb84fd830403221e48f
MD5 9716372508103ef6a050c0de6685c3a1
SHA1 674ad8128d17418474a2b4615da81c935d4d7f9c
SHA512 6738de8f90602772486519971669c96a180d11a523c2870b34e94d93e5c5171769c26459d93cf220b44a6924b01aff485e9e4f1dddc817cb758992575ab62aed
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
464	3424	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	464	WerFault.exe
Token: SeBackupPrivilege	464	WerFault.exe
Token: SeDebugPrivilege	464	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\674ad8128d17418474a2b4615da81c935d4d7f9c.exe
"C:\Users\Admin\AppData\Local\Temp\674ad8128d17418474a2b4615da81c935d4d7f9c.exe"
1⤵
PID:3424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 232
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads