f9360028f0313e3bf8b595aa92ddef1b21bd12e4dc79c636a11aaed160ff9b4d | Triage

Analysis

max time kernel
122s
max time network
135s
platform
windows10_x64
resource
win10-en-20211208
submitted
28-01-2022 17:22

Sharing

Report Analysis Logs

General

Target

674ad8128d17418474a2b4615da81c935d4d7f9c.exe
Size

160KB
MD5

9716372508103ef6a050c0de6685c3a1
SHA1

674ad8128d17418474a2b4615da81c935d4d7f9c
SHA256

ae9600cb391f447933e29069ca3000bb61a005d58fe14eb84fd830403221e48f
SHA512

6738de8f90602772486519971669c96a180d11a523c2870b34e94d93e5c5171769c26459d93cf220b44a6924b01aff485e9e4f1dddc817cb758992575ab62aed

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

464 3424 WerFault.exe 674ad8128d17418474a2b4615da81c935d4d7f9c.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe
464	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 464 WerFault.exe
Token: SeBackupPrivilege 464 WerFault.exe
Token: SeDebugPrivilege 464 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\674ad8128d17418474a2b4615da81c935d4d7f9c.exe
"C:\Users\Admin\AppData\Local\Temp\674ad8128d17418474a2b4615da81c935d4d7f9c.exe"
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 232
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...