Analysis
-
max time kernel
111s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe
Resource
win10v2004-20220812-en
General
-
Target
e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe
-
Size
120KB
-
MD5
1348244c3cd2958b109129818a8c9896
-
SHA1
ad0e92b25e795fb37568a47fbf5749e119c53220
-
SHA256
e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8
-
SHA512
658aa8b6be8be39bbfce335f93221ba5690bb3e2e726f823aaba8773cb3413ed4481fb777a9f7627c36ebc0fe003826840fc33b33dee99afc3b678c381f7216f
-
SSDEEP
1536:QIDThSFWEv7NyArVF3qmRIjbPT6XpOPzmsLPtTh0PE:phSFWETNykFaygbipEzLLPRh0M
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4900 3756 WerFault.exe 77 -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeCreatePagefilePrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeShutdownPrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeCreatePagefilePrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeShutdownPrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeCreatePagefilePrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeShutdownPrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeCreatePagefilePrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeShutdownPrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe Token: SeCreatePagefilePrivilege 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3756 e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe"C:\Users\Admin\AppData\Local\Temp\e83fe35b09b2f3a46183273e748b7d269e8e4f313cdb0cacbb9635be9cfb71e8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 4722⤵
- Program crash
PID:4900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3756 -ip 37561⤵PID:4984